Описание
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
Ссылки
- Issue Tracking
- ExploitIssue TrackingMitigation
- Third Party Advisory
- Product
- Product
- Third Party Advisory
Уязвимые конфигурации
EPSS
7.2 High
CVSS3
Дефекты
Связанные уязвимости
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
Уязвимость функции delete_queue() программного межсетевого экрана Netgate pfSense, позволяющая нарушителю выполнить произвольный код
EPSS
7.2 High
CVSS3