Back to feed
EUVD-2015-2393 · Published Apr 10, 2015
Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deletefile parameter.
Technologies
Netgate Pfsense
Weaknesses
CWE-352
CVSS scores
- v2.06.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
- http://packetstormsecurity.com/files/131022/pfSense-2.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
- https://www.exploit-db.com/exploits/36506/
- https://www.htbridge.com/advisory/HTB23251
- http://www.securityfocus.com/archive/1/534987/100/0/threaded
- http://www.securityfocus.com/bid/73344
- https://www.pfsense.org/security/advisories/pfSense-SA-15_04.webgui.asc
Potentially impacted assets
See if this affects your attack surface
