CVE-2020-19678: Path Traversal

Published Apr 6, 2023

Updated

Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensitive information via the file parameter to suricata/suricatalogsbrowser.php.

Affected Software

3 affected components

OISF Suricata=1.4.6

pfSense pfSense=2.1.3

pfSense Suricata package=1.0.1

Remediation

Patch Available

https://github.com/pfsense/pfsense-packages/commit/59ed3438729fd56452f58a0f79f0c288db982ac3

Event History

Apr 6, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·06:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2020-19678?

The severity of CVE-2020-19678 is high (7.5).

What is the CWE of CVE-2020-19678?

The CWE of CVE-2020-19678 is CWE-22.

Which software versions are affected by CVE-2020-19678?

Pfsense v.2.1.3, Pfsense Suricata v.1.4.6 pkg v.1.0.1 are affected by CVE-2020-19678.

How can a remote attacker exploit CVE-2020-19678?

A remote attacker can exploit CVE-2020-19678 by using the file parameter to suricata/suricata_logs_browser.php to perform directory traversal and obtain sensitive information.

Where can I find more information about CVE-2020-19678?

You can find more information about CVE-2020-19678 at the following references: http://www.2ngon.com/2015/01/lfi-vulnerability-suricata-146-pkg-v101.html, https://github.com/pfsense/pfsense-packages/commit/59ed3438729fd56452f58a0f79f0c288db982ac3, and https://pastebin.com/8dj59053.