CVE-2015-6510: XSS
Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) srctrack, (2) usemfstmpsize, or (3) usemfsvarsize parameter to systemadvancedmisc.php; the (4) port, (5) snaplen, or (6) count parameter to diagpacketcapture.php; the (7) pppoeresethour, (8) pppoeresetminute, (9) wpagrouprekey, or (10) wpagmkrekey parameter to interfaces.php; the (11) pppoeresethour or (12) pppoeresetminute parameter to interfacespppsedit.php; the (13) member[] parameter to interfacesqinqedit.php; the (14) port or (15) retry parameter to loadbalancerpooledit.php; the (16) pkgrepourl parameter to pkgmgrsettings.php; the (17) zone parameter to servicescaptiveportal.php; the port parameter to (18) servicesdnsmasq.php or (19) servicesunbound.php; the (20) cachemaxttl or (21) cacheminttl parameter to servicesunboundadvanced.php; the (22) sshport parameter to systemadvancedadmin.php; the (23) id, (24) tunable, (25) descr, or (26) value parameter to systemadvancedsysctl.php; the (27) firmwareurl, (28) repositoryurl, or (29) branch parameter to systemfirmwaresettings.php; the (30) pfsyncpeerip, (31) synchronizetoip, (32) username, or (33) passwordfld parameter to systemhasync.php; the (34) maxmss parameter to vpnipsecsettings.php; the (35) ntpserver1, (36) ntpserver2, (37) winsserver1, or (38) winsserver2 parameter to vpnopenvpncsc.php; or unspecified parameters to (39) loadbalancerrelayaction.php, (40) loadbalancerrelayactionedit.php, (41) loadbalancerrelayprotocol.php, or (42) loadbalancerrelayprotocoledit.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-6510?
CVE-2015-6510 is classified as a medium severity vulnerability due to its potential for remote exploitation via cross-site scripting.
How do I fix CVE-2015-6510?
To fix CVE-2015-6510, upgrade pfSense to version 2.2.3 or later.
What software versions are affected by CVE-2015-6510?
CVE-2015-6510 affects pfSense versions prior to 2.2.3.
What types of attacks are possible with CVE-2015-6510?
CVE-2015-6510 allows remote attackers to perform cross-site scripting attacks, potentially injecting arbitrary scripts into the web interface.
Where can I find more information about CVE-2015-6510?
Additional information about CVE-2015-6510 can be found in the official pfSense security advisory.