CVE-2019-16915 — Path Traversal in Pfsense

CWE-22 — Path TraversalCWE-20 — Improper Input Validation3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
2.7%
top 14.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Netgate Pfsense
Timeline
PublishedSep 26
Latest updateMay 24

Description

An issue was discovered in pfSense through 2.4.4-p3. widgets/widgets/picture.widget.php uses the widgetkey parameter directly without sanitization (e.g., a basename call) for a pathname to file_get_contents or file_put_contents.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶NVDnetgate/pfsense< 2.4.4+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-34rj-f5pg-64rh: An issue was discovered in pfSense through 2↗2022-05-24
▶
CVEList
CVE-2019-16915: An issue was discovered in pfSense through 2↗2019-09-26
▶
CVE-2019-16915 — Path Traversal in Netgate Pfsense | cvebase