CVE-2016-10709

pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.
Configurations

Configuration 1 (hide)

cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:*

History

21 Nov 2024, 02:44

Type Values Removed Values Added
References () https://www.exploit-db.com/exploits/39709/ - Exploit, Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/39709/ - Exploit, Third Party Advisory, VDB Entry
References () https://www.pfsense.org/security/advisories/pfSense-SA-16_01.webgui.asc - Vendor Advisory () https://www.pfsense.org/security/advisories/pfSense-SA-16_01.webgui.asc - Vendor Advisory
References () https://www.rapid7.com/db/modules/exploit/unix/http/pfsense_graph_injection_exec - Exploit, Third Party Advisory () https://www.rapid7.com/db/modules/exploit/unix/http/pfsense_graph_injection_exec - Exploit, Third Party Advisory
References () https://www.security-assessment.com/files/documents/advisory/pfsenseAdvisory.pdf - Exploit, Third Party Advisory () https://www.security-assessment.com/files/documents/advisory/pfsenseAdvisory.pdf - Exploit, Third Party Advisory

Information

Published : 2018-01-22 04:29

Updated : 2024-11-21 02:44


NVD link : CVE-2016-10709

Mitre link : CVE-2016-10709

CVE.ORG link : CVE-2016-10709


JSON object : View

Products Affected

pfsense

  • pfsense
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')