CVE-2015-6509: XSS
Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) proxypass parameter to systemadvancedmisc.php; (2) adaptiveend, (3) adaptivestart, (4) maximumstates, (5) maximumtableentries, or (6) aliasesresolveinterval parameter to systemadvancedfirewall.php; (7) proxyurl, (8) proxyuser, or (9) proxyport parameter to systemadvancedmisc.php; or (10) name, (11) notificationname, (12) ipaddress, (13) password, (14) smtpipaddress, (15) smtpport, (16) smtpfromaddress, (17) smtpnotifyemailaddress, (18) smtpusername, or (19) smtppassword parameter to systemadvancednotifications.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-6509?
CVE-2015-6509 is considered a medium severity vulnerability due to the potential for remote attackers to inject arbitrary scripts.
How do I fix CVE-2015-6509?
To fix CVE-2015-6509, upgrade pfSense to version 2.2.3 or later where the vulnerabilities are patched.
What types of attacks can occur due to CVE-2015-6509?
CVE-2015-6509 can allow cross-site scripting (XSS) attacks, enabling remote attackers to execute arbitrary web scripts in the context of the user's session.
Which versions of pfSense are affected by CVE-2015-6509?
pfSense versions before 2.2.3, specifically up to 2.2.2, are affected by CVE-2015-6509.
What components of pfSense are vulnerable in CVE-2015-6509?
The vulnerable components in CVE-2015-6509 include the parameters proxypass, adaptiveend, adaptivestart, maximumstates, maximumtableentries, and aliasesresolve.