PT-2019-12504 · Netgate+1 · Pfsense+1

Arnaud Cordier · Published 2019-05-20 · Updated 2020-08-24 · CVE-2019-11816

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 19.1.8 pfsense versions prior to 2.4.4-p3

Description The issue is related to incorrect access control in the WebUI, allowing remote authenticated users to escalate privileges to administrator via a specially crafted request.

Recommendations For OPNsense versions prior to 19.1.8, update to version 19.1.8 or later. For pfsense versions prior to 2.4.4-p3, update to version 2.4.4-p3 or later.

Fix

Related Identifiers

CVE-2019-11816

Affected Products

Opnsense

Pfsense

References · 4

• https://forum.opnsense.org/index.php?topic=12787.0 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11816 · Vendor Advisory
• https://netgate.com/blog/pfsense-2-4-4-release-p3-now-available.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11816 · Security Note