Path Traversal in Netgate Pfsense

CVE-2014-4689

Absolute path traversal vulnerability in pkg_edit.php in pfSense before 2.1.4 allows remote attackers to read arbitrary XML files via a full pathname in the xml parameter.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.028 (84.6th percentile) — read the EPSS interpretation.

Affected products

Netgate Pfsense
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

References

cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)