PT-2017-14294 · Artica · Artica Pandora Fms

Published 2017-10-27 · Updated 2017-11-14 · CVE-2017-15935

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Artica Pandora FMS version 7.0

Description The issue allows for remote PHP code execution through the manager files function. This can only be exploited by administrators who upload a PHP file.

Recommendations For Artica Pandora FMS version 7.0, restrict access to the manager files function to prevent unauthorized PHP file uploads until a fix is available. As a temporary workaround, consider disabling the ability for administrators to upload PHP files through this function.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2017-15935

Affected Products

Artica Pandora Fms

References · 3

• https://osv.dev/vulnerability/CVE-2017-15935 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15935 · Security Note
• https://medium.com/stolabs/security-issue-on-pandora-fms-enterprise-be630059a72d · Note