CVE-2014-4693

Published: Jul 2, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the eng parameter to snort_import_aliases.php or (2) unspecified variables to snort_select_alias.php.

Affected (3)

Products: Netgate: Pfsense · Pfsense: Snort Package

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Netgate Pfsense	Up to 2.1.4
Netgate Pfsense	Version 2.1.3
Pfsense Snort Package	Up to 3.0.12

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://pfsense.org/security/advisories/pfSense-SA-14_13.packages.asc

Source: cve@mitre.org

Vendor Advisory

https://pfsense.org/security/advisories/pfSense-SA-14_13.packages.asc

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.