PT-2019-15906 · Artica · Pandora Fms

K4M1Ll0 + 1 · Published 2019-12-26 · Updated 2024-08-05 · CVE-2019-19681

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pandora FMS versions 7.x

Description The issue allows for remote code execution with an authenticated user who has the ability to modify the alert system, potentially enabling the execution of commands as root or Administrator. It is noted that the product vendor disputes the existence of this issue as described, citing the requirement of admin rights to create alert commands and the capability of the extended ACL system to restrict access to specific configuration sections.

Recommendations For Pandora FMS versions 7.x, ensure that admin rights are strictly controlled and consider utilizing the extended ACL system to disable access to sensitive sections of the configuration, such as defining new alert commands, to minimize potential risks.

Exploit

Fix

RCE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2019-19681

Affected Products

Pandora Fms

References · 6

• 🔥 https://medium.com/@k4m1ll0/remote-code-execution-vulnerability-in-pandorafms-7-x-8ce55d4b1d5a · Exploit
• https://osv.dev/vulnerability/CVE-2019-19681 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19681 · Security Note
• https://medium.com/%40k4m1ll0/remote-code-execution-vulnerability-in-pandorafms-7-x-8ce55d4b1d5a · Note
• https://k4m1ll0.com/cve-2019-19681.html · Note
• https://pandorafms.com/blog/pandora-fms-vulnerability · Note