PT-2010-5376
CVE-2010-4246
·
Published
2010-12-07
·
Updated
2010-12-10
Description by
CVSS 2.0
4.3
MediumMetricsAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions
pfSense versions 1.2.3 through 2 beta 4
Description
The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the
ifnum or ifname parameters in the graph.php file.Recommendations
For pfSense version 1.2.3, avoid using the
ifnum and ifname parameters in the graph.php file until a patch is available.
For pfSense version 2 beta 4, restrict access to the graph.php file to minimize the risk of exploitation.Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾