PT-2022-14868 · Pfsense · Pfsense-Pkg-Wireguard

Yutaka Watanabe · Published 2022-03-07 · Updated 2022-03-15 · CVE-2022-21132

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions pfSense-pkg-WireGuard versions 0.1.5 through 0.1.5 3 pfSense-pkg-WireGuard versions 0.1.6 through 0.1.6 0

Description A directory traversal issue allows a remote authenticated attacker to lead a pfSense user to view a file outside the public folder.

Recommendations For pfSense-pkg-WireGuard versions 0.1.5 through 0.1.5 3, update to version 0.1.5 4 or later. For pfSense-pkg-WireGuard versions 0.1.6 through 0.1.6 0, update to version 0.1.6 1 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-21132

Affected Products

Pfsense-Pkg-Wireguard

References · 5

• https://github.com/pfsense/FreeBSD-ports/commits/devel/net/pfSense-pkg-WireGuard · Patch
• https://osv.dev/vulnerability/CVE-2022-21132 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21132 · Security Note
• https://t.me/cibsecurity/38709 · Telegram Post
• https://jvn.jp/en/jp/JVN85572374/index.html · Note