CVE-2014-4695
First published: Wed Jul 02 2014(Updated: )
Multiple open redirect vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the referer parameter to snort_rules_flowbits.php or (2) the returl parameter to snort_select_alias.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pfSense | <=2.1.4 | |
| pfSense | =2.1.3 | |
| Netgate pfSense ACME Package | <=3.0.12 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2014-4695?
CVE-2014-4695 has a medium severity rating as it allows attackers to exploit open redirect vulnerabilities to conduct phishing attacks.
How do I fix CVE-2014-4695?
To fix CVE-2014-4695, upgrade Snort package to version 3.0.13 or later in pfSense.
What versions of pfSense are affected by CVE-2014-4695?
CVE-2014-4695 affects pfSense versions up to 2.1.4 and the Snort package versions up to 3.0.12.
What is an open redirect vulnerability in the context of CVE-2014-4695?
An open redirect vulnerability allows an attacker to redirect users to an untrusted site, which can facilitate phishing attacks.
What actions should users take if they are using vulnerable versions related to CVE-2014-4695?
Users should immediately update their pfSense and Snort package to the latest secure versions to mitigate the risk.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/severity
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/netgate
- canonical/pfsense
- version/pfsense/2.1.4
- version/pfsense/2.1.3
- vendor/pfsense
- canonical/netgate pfsense acme package
- version/netgate pfsense acme package/3.0.12