PT-2019-15567 · Freeradius · Freeradius3

Publicado 2019-11-02 · Atualizado 2019-11-07 · CVE-2019-18667

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions freeradius3 package versions prior to 0.15.7 3 for pfSense on FreeBSD

Description The issue allows a user with an XSS payload as username or password to execute arbitrary JavaScript code on a victim's browser. This is due to a vulnerability in the /usr/local/www/freeradius view config.php file.

Recommendations For freeradius3 package versions prior to 0.15.7 3, update to version 0.15.7 3 or later to resolve the issue. As a temporary workaround, consider restricting access to the /usr/local/www/freeradius view config.php file to minimize the risk of exploitation. Avoid using XSS payloads in the username or password fields until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-18667

Produtos afetados

Freeradius3

Referências · 3

• https://github.com/pfsense/FreeBSD-ports/commit/30b22b6b0db7b73732a5da346afca66dc244e02a · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2019-18667 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-18667 · Aviso do Fabricante