Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing files on the file system, which may result in arbitrary command execution.
References
| Link | Resource |
|---|---|
| https://docs.netgate.com/downloads/pfSense-SA-22_01.webgui.asc | Mitigation Patch Vendor Advisory |
| https://jvn.jp/en/jp/JVN87751554/index.html | Patch Third Party Advisory |
| https://docs.netgate.com/downloads/pfSense-SA-22_01.webgui.asc | Mitigation Patch Vendor Advisory |
| https://jvn.jp/en/jp/JVN87751554/index.html | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://docs.netgate.com/downloads/pfSense-SA-22_01.webgui.asc - Mitigation, Patch, Vendor Advisory | |
| References | () https://jvn.jp/en/jp/JVN87751554/index.html - Patch, Third Party Advisory |
08 Aug 2023, 14:21
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-22 |
07 Apr 2022, 20:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://jvn.jp/en/jp/JVN87751554/index.html - Patch, Third Party Advisory | |
| References | (MISC) https://docs.netgate.com/downloads/pfSense-SA-22_01.webgui.asc - Mitigation, Patch, Vendor Advisory | |
| CPE | cpe:2.3:a:netgate:pfsense_plus:*:*:*:*:*:*:*:* cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 8.5
v3 : 8.8 |
| CWE | NVD-CWE-Other |
31 Mar 2022, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-03-31 08:15
Updated : 2024-11-21 06:53
NVD link : CVE-2022-26019
Mitre link : CVE-2022-26019
CVE.ORG link : CVE-2022-26019
JSON object : View
Products Affected
netgate
- pfsense_plus
- pfsense
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')