CVE-2015-2294: XSS
Multiple cross-site scripting (XSS) vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) zone parameter to statuscaptiveportal.php; (2) if or (3) dragtable parameter to firewallrules.php; (4) queue parameter in an add action to firewallshaper.php; (5) id parameter in an edit action to servicesunboundacls.php; or (6) filterlogentriestime, (7) filterlogentriessourceipaddress, (8) filterlogentriessourceport, (9) filterlogentriesdestinationipaddress, (10) filterlogentriesinterfaces, (11) filterlogentriesdestinationport, (12) filterlogentriesprotocolflags, or (13) filterlogentriesqty parameter to diaglogsfilter.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2294?
The severity of CVE-2015-2294 is considered to be medium due to the potential for remote code execution via cross-site scripting.
How do I fix CVE-2015-2294?
To fix CVE-2015-2294, upgrade pfSense to version 2.2.1 or later, which addresses the identified XSS vulnerabilities.
What types of attacks are possible with CVE-2015-2294?
CVE-2015-2294 allows attackers to perform cross-site scripting attacks, potentially leading to session hijacking or data theft.
Which versions of pfSense are affected by CVE-2015-2294?
Versions of pfSense prior to 2.2.1 are affected by CVE-2015-2294.
What are the specific parameters exploited in CVE-2015-2294?
CVE-2015-2294 exploits the zone, if, dragtable, and queue parameters in various pfSense web interfaces.