PT-2019-15906 · Artica · Pandora Fms

K4M1Ll0 + 1 · Publicado 2019-12-26 · Atualizado 2024-08-05 · CVE-2019-19681

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pandora FMS versions 7.x

Description The issue allows for remote code execution with an authenticated user who has the ability to modify the alert system, potentially enabling the execution of commands as root or Administrator. It is noted that the product vendor disputes the existence of this issue as described, citing the requirement of admin rights to create alert commands and the capability of the extended ACL system to restrict access to specific configuration sections.

Recommendations For Pandora FMS versions 7.x, ensure that admin rights are strictly controlled and consider utilizing the extended ACL system to disable access to sensitive sections of the configuration, such as defining new alert commands, to minimize potential risks.

Exploit

Correção

RCE

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2019-19681

Produtos afetados

Pandora Fms

Referências · 6

• 🔥 https://medium.com/@k4m1ll0/remote-code-execution-vulnerability-in-pandorafms-7-x-8ce55d4b1d5a · Exploit
• https://osv.dev/vulnerability/CVE-2019-19681 · Aviso do Fabricante
• https://medium.com/%40k4m1ll0/remote-code-execution-vulnerability-in-pandorafms-7-x-8ce55d4b1d5a · Nota
• https://k4m1ll0.com/cve-2019-19681.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-19681 · Nota de Segurança
• https://pandorafms.com/blog/pandora-fms-vulnerability · Nota