Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensitive information via the file parameter to suricata/suricata_logs_browser.php.
References
| Link | Resource |
|---|---|
| http://www.2ngon.com/2015/01/lfi-vulnerability-suricata-146-pkg-v101.html | Broken Link |
| https://github.com/pfsense/pfsense-packages/commit/59ed3438729fd56452f58a0f79f0c288db982ac3 | Patch |
| https://pastebin.com/8dj59053 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
18 Apr 2023, 02:31
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:pfsense:pfsense:2.1.3:*:*:*:*:*:*:* cpe:2.3:a:pfsense:suricata_package:1.0.1:*:*:*:*:*:*:* cpe:2.3:a:oisf:suricata:1.4.6:*:*:*:*:*:*:* |
|
| CWE | CWE-22 | |
| First Time |
Pfsense
Oisf Oisf suricata Pfsense suricata Package Pfsense pfsense |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | (MISC) https://github.com/pfsense/pfsense-packages/commit/59ed3438729fd56452f58a0f79f0c288db982ac3 - Patch | |
| References | (MISC) https://pastebin.com/8dj59053 - Exploit, Third Party Advisory | |
| References | (MISC) http://www.2ngon.com/2015/01/lfi-vulnerability-suricata-146-pkg-v101.html - Broken Link |
06 Apr 2023, 19:50
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-06 18:15
Updated : 2023-12-10 15:01
NVD link : CVE-2020-19678
Mitre link : CVE-2020-19678
CVE.ORG link : CVE-2020-19678
JSON object : View
Products Affected
pfsense
- suricata_package
- pfsense
oisf
- suricata
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')