CVE-2015-2295

Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deletefile parameter.

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

65.72% chance of exploitation in the next 30 days, 99th percentile

Published

2015-04-10

Updated

2024-08-06

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/36506

References

• CVE Record
• NVD entry

Related

• CVE-2015-2294
• CVE-2015-2314
• CVE-2015-2292
• CVE-2015-2315
• CVE-2015-2291
• CVE-2015-2321