PT-2010-5400 · Artica · Pandora Fms

Jgaliana + 1 · Published 2010-12-02 · Updated 2018-10-10 · CVE-2010-4282

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Pandora FMS versions prior to 3.1.1

Description The issue allows remote attackers to include and execute arbitrary local files via specific parameters in various PHP files. This can be achieved through the "page" parameter to "ajax.php", the "id" parameter to "general/pandora help.php", or the "layout" parameter to "operation/agentes/networkmap.php". This could potentially allow attackers to create, modify, or delete arbitrary local files.

Recommendations For versions prior to 3.1.1, update to version 3.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected PHP files, specifically "ajax.php", "general/pandora help.php", and "operation/agentes/networkmap.php", until the update can be applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2010-4282

Affected Products

Pandora Fms

References · 12

• 🔥 http://exploit-db.com/exploits/15643 · Exploit
• 🔥 https://exploit-db.com/exploits/15643 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-4282 · Security Note
• http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download · Patch
• http://securityfocus.com/bid/45112 · Patch
• http://seclists.org/fulldisclosure/2010/Nov/326 · Note
• http://osvdb.org/69545 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4282 · Note
• http://osvdb.org/69544 · Note
• http://securityfocus.com/archive/1/514939/100/0/threaded · Note
• http://secunia.com/advisories/42347 · Note
• http://osvdb.org/69543 · Note