A command injection vulnerability in the function... · CVE-2023-27253 · GitHub Advisory Database · GitHub

A command injection vulnerability in the function...

High severity Unreviewed Published Mar 18, 2023 to the GitHub Advisory Database • Updated Jul 14, 2023

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.

References

Published by the National Vulnerability Database

Mar 17, 2023

Published to the GitHub Advisory Database Mar 18, 2023

Last updated Jul 14, 2023

Severity

High

8.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H