medium4.3Public exploit code
CVE-2010-4412
Multiple cross-site scripting (XSS) vulnerabilities in pfSense 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via (1) the id parameter …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- pfSense - 'interfaces.php?if' Cross-Site Scripting2010-11-08 · remote · hardware · Verified
- pfSense - 'status_graph.php?if' Cross-Site Scripting2010-11-08 · remote · hardware · Verified
- pfSense - 'pkg.php?xml' Cross-Site Scripting2010-11-08 · remote · hardware · Verified
- pfSense - 'pkg_edit.php?id' Cross-Site Scripting2010-11-08 · remote · hardware · Verified
Impact
Multiple cross-site scripting (XSS) vulnerabilities in pfSense 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via (1) the id parameter in an olsrd.xml action to pkg_edit.php, (2) the xml parameter to pkg.php, or the if parameter to (3) status_graph.php or (4) interfaces.php, a different vulnerability than CVE-2008-1182 and CVE-2010-4246.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bsdperimeter | Pfsense | Version 2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://openwall.com/lists/oss-security/2010/11/22/18
- http://openwall.com/lists/oss-security/2010/11/24/7
- http://openwall.com/lists/oss-security/2010/12/06/7
- http://seclists.org/fulldisclosure/2010/Nov/43
- http://openwall.com/lists/oss-security/2010/11/22/18
- http://openwall.com/lists/oss-security/2010/11/24/7
- http://openwall.com/lists/oss-security/2010/12/06/7
- http://seclists.org/fulldisclosure/2010/Nov/43