CVE-2022-45436: fallo de gravedad media en Artica PFMS Pandora FMS
Stored cross-site scripting vulnerability in network maps editor feature
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.1epss 0.6%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). As a manager privilege user , create a network map containing name as xss payload. Once created, admin user must click on the edit network maps and XSS payload will be executed, which could be used for stealing admin users cookie value.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Productos afectados
Artica PFMS · Pandora FMSCVEs relacionadas — Artica PFMS Pandora FMS
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-1648MEDIUMRelative Path Traversal to Remote Code Execution in File ManagerEPSS 1.4%CVE-2022-0507MEDIUMVulnerability: Authenticated SQL Injection in APIEPSS 1.2%CVE-2023-24517MEDIUMRemote Code Execution via Unrestricted File UploadEPSS 1.0%CVE-2022-43979MEDIUMPath Traversal leading to Local File InclusionEPSS 0.8%CVE-2022-26310HIGHImproper Authorization in User Management to Vertical Privilege EscalationEPSS 0.7%CVE-2023-2807MEDIUMAuthentication bypass in password reset processEPSS 0.6%