CVE-2015-6509: XSS
First published: Tue Aug 18 2015(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) proxypass parameter to system_advanced_misc.php; (2) adaptiveend, (3) adaptivestart, (4) maximumstates, (5) maximumtableentries, or (6) aliasesresolveinterval parameter to system_advanced_firewall.php; (7) proxyurl, (8) proxyuser, or (9) proxyport parameter to system_advanced_misc.php; or (10) name, (11) notification_name, (12) ipaddress, (13) password, (14) smtpipaddress, (15) smtpport, (16) smtpfromaddress, (17) smtpnotifyemailaddress, (18) smtpusername, or (19) smtppassword parameter to system_advanced_notifications.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Netgate pfSense Community Edition | <=2.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2015-6509?
CVE-2015-6509 is considered a medium severity vulnerability due to the potential for remote attackers to inject arbitrary scripts.
How do I fix CVE-2015-6509?
To fix CVE-2015-6509, upgrade pfSense to version 2.2.3 or later where the vulnerabilities are patched.
What types of attacks can occur due to CVE-2015-6509?
CVE-2015-6509 can allow cross-site scripting (XSS) attacks, enabling remote attackers to execute arbitrary web scripts in the context of the user's session.
Which versions of pfSense are affected by CVE-2015-6509?
pfSense versions before 2.2.3, specifically up to 2.2.2, are affected by CVE-2015-6509.
What components of pfSense are vulnerable in CVE-2015-6509?
The vulnerable components in CVE-2015-6509 include the parameters proxypass, adaptiveend, adaptivestart, maximumstates, maximumtableentries, and aliasesresolve.
- agent/type
- agent/references
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/netgate
- canonical/netgate pfsense community edition
- version/netgate pfsense community edition/2.2.2