In pfSense CE /usr/local/www/snort/snort_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related characters/strings before being used to check if a file exists. While the contents of the file cannot be read, the server reveals whether a file exists, which allows an attacker to enumerate files on the target. The attacker must be authenticated with at least "WebCfg - Services: Snort package" permissions.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 09 Sep 2025 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In pfSense CE /usr/local/www/snort/snort_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related characters/strings before being used to check if a file exists. While the contents of the file cannot be read, the server reveals whether a file exists, which allows an attacker to enumerate files on the target. The attacker must be authenticated with at least "WebCfg - Services: Snort package" permissions. | |
| Title | Netgate pfSense CE Snort package v4.1.6_25 Directory Traversal Information Disclosure | |
| Weaknesses | CWE-22 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2025-09-09T19:59:14.136Z
Reserved: 2025-04-15T19:15:22.567Z
Link: CVE-2025-34173
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-09-09T20:15:38.560
Modified: 2025-09-09T20:15:38.560
Link: CVE-2025-34173
Redhat
No data.
OpenCVE Enrichment
No data.