CVE-2019-16701

pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters in a parameter value.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*
cpe:2.3:a:netgate:pfsense:2.4.4:-:*:*:*:*:*:*
cpe:2.3:a:netgate:pfsense:2.4.4:p1:*:*:*:*:*:*
cpe:2.3:a:netgate:pfsense:2.4.4:p2:*:*:*:*:*:*
cpe:2.3:a:netgate:pfsense:2.4.4:p3:*:*:*:*:*:*

History

21 Nov 2024, 04:31

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/154587/pfSense-2.3.4-2.4.4-p3-Remote-Code-Injection.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/154587/pfSense-2.3.4-2.4.4-p3-Remote-Code-Injection.html - Exploit, Third Party Advisory, VDB Entry
References () https://github.com/pfsense/pfsense/commits/master - Third Party Advisory () https://github.com/pfsense/pfsense/commits/master - Third Party Advisory
References () https://hackernews.blog/pfsense-2-3-4-2-4-4-p3-remote-code-injection/#more - Exploit, Third Party Advisory () https://hackernews.blog/pfsense-2-3-4-2-4-4-p3-remote-code-injection/#more - Exploit, Third Party Advisory

Information

Published : 2019-09-25 16:15

Updated : 2024-11-21 04:31


NVD link : CVE-2019-16701

Mitre link : CVE-2019-16701

CVE.ORG link : CVE-2019-16701


JSON object : View

Products Affected

netgate

  • pfsense
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')