CVE-2022-43979: fallo de gravedad media en Artica PFMS Pandora FMS
Path Traversal leading to Local File Inclusion
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.9epss 0.8%
There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted does not contain malicious characteres, but this check is insufficient. An attacker could insert an absolute path to overcome the heck, thus being able to incluse any PHP file that resides on the disk. The exploitation of this vulnerability could lead to a remote code execution.
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
Productos afectados
Artica PFMS · Pandora FMSCVEs relacionadas — Artica PFMS Pandora FMS
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-1648MEDIUMRelative Path Traversal to Remote Code Execution in File ManagerEPSS 1.4%CVE-2022-0507MEDIUMVulnerability: Authenticated SQL Injection in APIEPSS 1.2%CVE-2023-24517MEDIUMRemote Code Execution via Unrestricted File UploadEPSS 1.0%CVE-2022-26310HIGHImproper Authorization in User Management to Vertical Privilege EscalationEPSS 0.7%CVE-2023-2807MEDIUMAuthentication bypass in password reset processEPSS 0.6%CVE-2022-45436MEDIUMStored cross-site scripting vulnerability in network maps editor featureEPSS 0.6%