PT-2018-10405 · Artica · Artica Pandora Fms

Publicado 2018-06-15 · Atualizado 2018-08-14 · CVE-2018-11221

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Artica Pandora FMS versions prior to 7.23

Description The issue allows an attacker to perform an unauthenticated untrusted file upload. This is achieved through the update system, specifically via the "include/ajax/update manager.ajax" API endpoint. An attacker can upload an arbitrary plugin, potentially leading to further exploitation.

Recommendations For versions prior to 7.23, update to version 7.23 or later to resolve the issue. As a temporary workaround, consider restricting access to the "include/ajax/update manager.ajax" API endpoint to minimize the risk of exploitation.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-11221

Produtos afetados

Artica Pandora Fms

Referências · 4

• https://blog.hackercat.ninja/post/pandoras_box · Nota
• https://osv.dev/vulnerability/CVE-2018-11221 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-11221 · Nota de Segurança
• https://pandorafms.com/wp-content/uploads/2018/06/whats-new-723-EN.pdf · Aviso do Fabricante