PT-2017-14294 · Artica · Artica Pandora Fms

Publicado 2017-10-27 · Atualizado 2017-11-14 · CVE-2017-15935

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Artica Pandora FMS version 7.0

Description The issue allows for remote PHP code execution through the manager files function. This can only be exploited by administrators who upload a PHP file.

Recommendations For Artica Pandora FMS version 7.0, restrict access to the manager files function to prevent unauthorized PHP file uploads until a fix is available. As a temporary workaround, consider disabling the ability for administrators to upload PHP files through this function.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2017-15935

Produtos afetados

Artica Pandora Fms

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-15935 · Aviso do Fabricante
• https://medium.com/stolabs/security-issue-on-pandora-fms-enterprise-be630059a72d · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-15935 · Nota de Segurança