PT-2010-5400 · Artica · Pandora Fms

Jgaliana + 1 · Publicado 2010-12-02 · Atualizado 2018-10-10 · CVE-2010-4282

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Pandora FMS versions prior to 3.1.1

Description The issue allows remote attackers to include and execute arbitrary local files via specific parameters in various PHP files. This can be achieved through the "page" parameter to "ajax.php", the "id" parameter to "general/pandora help.php", or the "layout" parameter to "operation/agentes/networkmap.php". This could potentially allow attackers to create, modify, or delete arbitrary local files.

Recommendations For versions prior to 3.1.1, update to version 3.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected PHP files, specifically "ajax.php", "general/pandora help.php", and "operation/agentes/networkmap.php", until the update can be applied.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2010-4282

Produtos afetados

Pandora Fms

Referências · 12

• 🔥 http://exploit-db.com/exploits/15643 · Exploit
• 🔥 https://exploit-db.com/exploits/15643 · Exploit
• http://seclists.org/fulldisclosure/2010/Nov/326 · Nota
• http://osvdb.org/69545 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-4282 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4282 · Nota
• http://osvdb.org/69544 · Nota
• http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download · Correção
• http://securityfocus.com/archive/1/514939/100/0/threaded · Nota
• http://secunia.com/advisories/42347 · Nota
• http://osvdb.org/69543 · Nota
• http://securityfocus.com/bid/45112 · Correção