CVE-2019-12949: XSS
In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable code, via diagcommand.php and rrdfetchjson.php (timePeriod parameter), to a server. Then, the remote attacker can run any command with root privileges on that server.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-12949?
CVE-2019-12949 is a vulnerability in pfSense 2.4.4-p2 and 2.4.4-p3 that allows an attacker to upload arbitrary executable code to a server.
How can an attacker exploit CVE-2019-12949?
An attacker can trick an authenticated administrator into clicking on a button on a phishing page, which will execute the XSS attack and allow the attacker to upload arbitrary executable code.
What software versions are affected by CVE-2019-12949?
pfSense versions 2.4.4-p2 and 2.4.4-p3 are affected by CVE-2019-12949.
What is the severity of CVE-2019-12949?
CVE-2019-12949 has a severity rating of 6.1 (Medium).
Is there a fix for CVE-2019-12949?
Yes, updating pfSense to a patched version will fix the vulnerability.