Design/Logic Flaw

2019-05-2022:29:00

PRIOn knowledge base

www.prio-n.com

6.8 Medium

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.4%

JSON

Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted request.

CPENameOperatorVersion
pfsenseeq2.4.4 p1
pfsensele2.4.4
pfsenseeq2.4.4 p2
opnsenselt19.1.8

Name	Operator	Version
pfsense	eq	2.4.4 p1
pfsense	le	2.4.4
pfsense	eq	2.4.4 p2
opnsense	lt	19.1.8

References

forum.opnsense.org/index.php?topic=12787.0

www.netgate.com/blog/pfsense-2-4-4-release-p3-now-available.html