Skip to content
Fencer Intel
medium 6.8

CVE-2015-2295 json

Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remot…

published 2015-04-10 11 y ago modified 2026-06-17 4 mo ago also EUVD-2015-2393

cvss
6.8
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
65.7%
EPSS 65.7% chance of exploitation in 30 days, percentile 99.2%
public exploits
1
Exploit-DB

Summary

Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deletefile parameter.

Timeline

  1. First public exploit (EDB-36506)
  2. Published

Exploit prediction

65.72% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-36506 pfSense 2.2 - Multiple Vulnerabilities webapps, 2015-03-26
  • packetstormsecurity.com http://packetstormsecurity.com/files/131022/pfSense-2.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html referenced PoC, tagged "exploit" by a source, unverified
  • htbridge.com https://www.htbridge.com/advisory/HTB23251 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-352 Cross-Site Request Forgery

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.