CVE-2014-4696

Estado: ModificadaMedia (5.8)—

Multiple open redirect vulnerabilities in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the referer parameter to suricata_rules_flowbits.php or (2) the returl parameter to suricata_select_alias.php.

CVSS

Versión: 2.0
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Puntuación base: 5.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 2.07%
Percentil entre todas las CVEs puntuadas: 81
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Netgate — Pfsense Pfsense — Suricata Package

CWE

NVD-CWE-Other

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2014-4696",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-07-02T10:35:26.207",
  "references": [
    {
      "url": "https://pfsense.org/security/advisories/pfSense-SA-14_13.packages.asc",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://pfsense.org/security/advisories/pfSense-SA-14_13.packages.asc",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple open redirect vulnerabilities in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the referer parameter to suricata_rules_flowbits.php or (2) the returl parameter to suricata_select_alias.php."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de redirección abierta en el paquete Suricata anterior a 1.0.6 para pfSense hasta 2.1.4 permiten a atacantes remotos redirigir usuarios hacia sitios web arbitrarios y realizar ataques de phishing a través del parámetro (1) referer en suricata_rules_flowbits.php o (2) returl en suricata_select_alias.php."
    }
  ],
  "lastModified": "2026-06-17T00:10:28.340",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41DC67D8-85E8-41E4-9BC2-86AF017CC779",
              "versionEndIncluding": "2.1.4"
            },
            {
              "criteria": "cpe:2.3:a:netgate:pfsense:2.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2CAA13A8-3B1E-4848-AB59-E385BC37E4E5"
            },
            {
              "criteria": "cpe:2.3:a:pfsense:suricata_package:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FC8077F-F731-44A2-BF9D-8CDBC1361221",
              "versionEndIncluding": "1.0.5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "Per: http://cwe.mitre.org/data/definitions/601.html\n\n\"CWE-601: URL Redirection to Untrusted Site ('Open Redirect')\"",
  "sourceIdentifier": "cve@mitre.org"
}