PT-2019-14865 · Netgate · Pfsense

Lorexxar233 · Published 2019-09-26 · Updated 2021-07-21 · CVE-2019-16915

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.4.4-p3

Description An issue was discovered where the widgetkey parameter in widgets/widgets/picture.widget.php is used directly without sanitization for a pathname to file get contents or file put contents.

Recommendations For versions prior to 2.4.4-p3, consider updating to a version that includes the necessary sanitization for the widgetkey parameter to prevent potential exploitation. As a temporary workaround, consider restricting access to the picture.widget.php file until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-16915

Affected Products

Pfsense

References · 5

• https://github.com/pfsense/pfsense/commit/2c544ac61ce98f716d50b8e5961d7dfba66804b5 · Patch
• https://osv.dev/vulnerability/CVE-2019-16915 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16915 · Security Note
• https://seebug.org/vuldb/ssvid-98024 · Note
• https://redmine.pfsense.org/issues/9610 · Note