PT-2014-6056 · Netgate · Pfsense
Published
2014-07-02
·
Updated
2019-05-30
·
CVE-2014-4690
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
pfSense versions prior to 2.1.4
Description
The issue allows remote attackers to read arbitrary .info files via a crafted path in the
pkg parameter to "pkg mgr install.php" and allows remote authenticated users to read arbitrary files via the downloadbackup parameter to "system firmware restorefullbackup.php".Recommendations
For versions prior to 2.1.4, update to version 2.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the "pkg mgr install.php" and "system firmware restorefullbackup.php" scripts until the update is applied. Avoid using the
pkg and downloadbackup parameters in the affected API endpoints until the issue is resolved.Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pfsense