Lucene search

[email protected]CVE-2018-20799

HistoryMar 01, 2019 - 3:29 p.m.

CVE-2018-20799

2019-03-0115:29:00

[email protected]

web.nvd.nist.gov

pfsense

2.4.4_1

ip blocking

authentication

bypass

security vulnerability

nvd

cve-2018-20799

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

38.1%

JSON

In pfSense 2.4.4_1, blocking of source IP addresses on the basis of failed HTTPS authentication is inconsistent with blocking of source IP addresses on the basis of failed SSH authentication (the behavior does not match the sshguard documentation), which might make it easier for attackers to bypass intended access restrictions.

Affected configurations

NVD

Node

netgatepfsenseMatch2.4.4p1

VendorProductVersionCPE
netgatepfsense2.4.4cpe:/a:netgate:pfsense:2.4.4:p1::

Vendor	Product	Version	CPE
netgate	pfsense	2.4.4	cpe:/a:netgate:pfsense:2.4.4:p1::

References

redmine.pfsense.org/issues/9223

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

38.1%

JSON

Related for CVE-2018-20799

cvelist1 nvd1 prion1 nessus1