Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2015-2295 — Cross-Site Request Forgery in Pfsense

CWE-352 — Cross-Site Request Forgery3 documents3 sources
Severity
6.8MEDIUMNVD
EPSS
34.6%
top 2.98%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Netgate Pfsense
Timeline
PublishedApr 10
Latest updateMay 14

Description

Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deletefile parameter.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages1 packages

🔴Vulnerability Details

1
GHSA
GHSA-mmrv-p6cv-33xm: Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup↗2022-05-14
▶

💥Exploits & PoCs

1
Exploit-DB
pfSense 2.2 - Multiple Vulnerabilities↗2015-03-26
▶
CVE-2015-2295 — Cross-Site Request Forgery in Pfsense | cvebase