PT-2020-12822 · Artica · Pandora Fms

Applebois · Published 2020-07-13 · Updated 2023-01-27 · CVE-2020-11749

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pandora FMS versions 7.0 NG through 746

Description The issue concerns Multiple XSS vulnerabilities in different browser views of Pandora FMS. It can be triggered by a network administrator scanning a SNMP device, leading to Cross Site Scripting (XSS) that allows arbitrary code execution, potentially enabling Remote Code Execution as root or apache2.

Recommendations For Pandora FMS versions 7.0 NG through 746, consider disabling the SNMP scanning feature until a patch is available to prevent potential exploitation of the XSS vulnerability. Restrict access to the browser views where the XSS vulnerability is present to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-11749

Affected Products

Pandora Fms

References · 7

• 🔥 https://medium.com/@tehwinsam/multiple-xss-on-pandorafms-7-0-ng-744-64b244b8523c · Exploit
• 🔥 https://exploit-db.com/exploits/48707 · Exploit
• 🔥 https://packetstormsecurity.com/files/158389/Pandora-FMS-7.0-NG-746-Script-Insertion-Code-Execution.htmlPoC · Exploit
• https://osv.dev/vulnerability/CVE-2020-11749 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11749 · Security Note
• https://pandorafms.com/downloads/whats-new-747-EN.pdf · Vendor Advisory
• https://medium.com/%40tehwinsam/multiple-xss-on-pandorafms-7-0-ng-744-64b244b8523c · Note