CVE-2014-4690 — Path Traversal in Pfsense

CWE-22 — Path Traversal3 documents3 sources
Severity
5.0MEDIUMNVD
EPSS
0.2%
top 59.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Netgate Pfsense
Timeline
PublishedJul 2
Latest updateMay 14

Description

Multiple directory traversal vulnerabilities in pfSense before 2.1.4 allow (1) remote attackers to read arbitrary .info files via a crafted path in the pkg parameter to pkg_mgr_install.php and allow (2) remote authenticated users to read arbitrary files via the downloadbackup parameter to system_firmware_restorefullbackup.php.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

▶NVDnetgate/pfsense2.1.3

🔴Vulnerability Details

1
GHSA
GHSA-x54r-fr2m-7j8m: Multiple directory traversal vulnerabilities in pfSense before 2↗2022-05-14
▶

💬Community

1
Bugzilla
CVE-2014-7828 freeipa: password not required when OTP in use↗2014-11-05
▶
CVE-2014-4690 — Path Traversal in Netgate Pfsense | cvebase