PT-2023-8737 · Unknown · Pandora Fms

CVE-2023-41786 · Publicado 2023-11-23 · Atualizado 2024-01-09

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pandora FMS versions 700 through 772

Description The issue is related to the exposure of sensitive information to unauthorized actors, allowing users with low privileges to download database backups. This can be exploited by a remote attacker to gain access to sensitive data. The vulnerability is associated with a lack of protection for service data.

Recommendations For versions 700 through 772, update to a version that includes a fix for this issue to prevent unauthorized access to database backups. As a temporary workaround, consider restricting access to the database backup functionality to minimize the risk of exploitation.

Correção

Exposure of Resource to Wrong Sphere

Information Disclosure

Enumeração de Fraquezas

CWE-668

CWE-200

Identificadores relacionados

BDU:2024-01769

CVE-2023-41786

Produtos afetados

Pandora Fms

Referências · 8

• https://osv.dev/vulnerability/CVE-2023-41786 · Aviso do Fabricante
• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures · Nota
• https://t.me/true_secator/5271 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2024-01769 · Nota de Segurança
• https://t.me/cvenotify/61725 · Publicação no Telegram
• https://https//pandorafms.com/en/security/common-vulnerabilities-and-exposures · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-41786 · Nota de Segurança
• https://t.me/cvenotify/61043 · Publicação no Telegram