Netgate pfSense 2.4.4 Patch 3

Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to run arbitrary code via the RootFolder field to acme_certificate_edit.php page of the ACME package.

Published: 2022-12-15T00:00:00.000Z
Updated: 2025-04-25T14:34:36.701Z

An issue was discovered in pfSense through 2.4.4-p3. widgets/widgets/picture.widget.php uses the widgetkey parameter directly without sanitization (e.g., a basename call) for a pathname to file_get_contents or file_put_contents.

Published: 2019-09-26T17:38:42.000Z
Updated: 2024-08-05T01:24:48.530Z

An XSS issue was discovered in pfSense through 2.4.4-p3. In services_captiveportal_mac.php, the username and delmac parameters are displayed without sanitization.

Published: 2019-09-26T17:38:53.000Z
Updated: 2024-08-05T01:24:48.605Z

pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters in a parameter value.

Published: 2019-09-25T15:45:56.000Z
Updated: 2024-08-05T01:17:41.164Z

diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csrf_callback() produces a "CSRF token expired" error and a Try Again button when a CSRF token is missing.

Published: 2019-09-26T18:38:48.000Z
Updated: 2024-08-05T01:17:41.055Z

In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable code, via diag_command.php and rrd_fetch_json.php (timePeriod parameter), to a server. Then, the remote attacker can run any command with root privileges on that server.

Published: 2019-06-25T10:55:17.000Z
Updated: 2024-08-04T23:32:55.584Z

Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php.

Published: 2019-06-03T02:28:08.000Z
Updated: 2024-08-04T23:24:38.689Z

Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php.

Published: 2019-06-03T02:27:47.000Z
Updated: 2024-08-04T23:24:39.165Z

In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action. The vulnerability occurs due to input validation errors.

Published: 2019-05-29T18:29:16.000Z
Updated: 2024-08-04T23:17:39.907Z