CVE-2016-10709 in pfSense
Summary
pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Reservation
01/21/2018
Disclosure
01/21/2018
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 112273 | pfSense status_rrd_graph_img.php os command injection | 78 | High | Official fix | CVE-2016-10709 |