CVE-2010-4282

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 20%

from disclosure to weapon0 days

Published on NVDDec 2

1st PoCNov 30

exploitation probability

20%top 3% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php.

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/15643unverified cve_referencewww.exploit-db.com/exploits/15643unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://osvdb.org/69543 http://osvdb.org/69544 http://osvdb.org/69545 http://seclists.org/fulldisclosure/2010/Nov/326 http://secunia.com/advisories/42347 http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download http://www.exploit-db.com/exploits/15643 http://www.securityfocus.com/archive/1/514939/100/0/threaded http://www.securityfocus.com/bid/45112