CVE-2020-19678

CVSS V2 None CVSS V3 None

Description

Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensitive information via the file parameter to suricata/suricata_logs_browser.php.

Overview

CVE ID
CVE-2020-19678

Assigner
cve@mitre.org

Vulnerability Status
Analyzed

Published Version
2023-04-06T18:15:08

Last Modified Date
2023-04-18T02:31:05

Weakness Enumerations

CWE	URL
CWE-22	http://cwe.mitre.org/data/definitions/22.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version Start	Version End
cpe:2.3:a:oisf:suricata:1.4.6:::::::*	1	OR
cpe:2.3:a:pfsense:pfsense:2.1.3:::::::*	1	OR
cpe:2.3:a:pfsense:suricata_package:1.0.1:::::::*	1	OR

References

Reference URL	Reference Tags
http://www.2ngon.com/2015/01/lfi-vulnerability-suricata-146-pkg-v101.html
https://github.com/pfsense/pfsense-packages/commit/59ed3438729fd56452f58a0f79f0c288db982ac3
https://pastebin.com/8dj59053

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2020-19678
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19678

History

Created	Old Value	New Value	Data Type	Notes
2023-04-17 04:17:29				Added to TrackCVE
2023-04-18 03:00:35		2023-04-18T02:31:05	CVE Modified Date	updated
2023-04-18 03:00:35	Undergoing Analysis	Analyzed	Vulnerability Status	updated
2023-04-18 03:00:35			Weakness Enumeration	new
2023-04-18 03:00:35			CPE Information	updated