CVE-2023-0828: medium-severity vulnerability in Artica PFMS Pandora FMS
Stored Cross Site Scripting in syslog section
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.7epss 0.3%
Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers users server. This issue affects Pandora FMS v767 version and prior versions on all platforms.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
Affected products
Artica PFMS · Pandora FMSRelated CVEs — Artica PFMS Pandora FMS
In the same product, most dangerous first.
CVE-2022-1648MEDIUMRelative Path Traversal to Remote Code Execution in File ManagerEPSS 1.4%CVE-2022-0507MEDIUMVulnerability: Authenticated SQL Injection in APIEPSS 1.2%CVE-2023-24517MEDIUMRemote Code Execution via Unrestricted File UploadEPSS 1.0%CVE-2022-43979MEDIUMPath Traversal leading to Local File InclusionEPSS 0.8%CVE-2022-26310HIGHImproper Authorization in User Management to Vertical Privilege EscalationEPSS 0.7%CVE-2023-2807MEDIUMAuthentication bypass in password reset processEPSS 0.6%