PT-2021-20941 · Unknown · Pandora Fms

K4M1Ll0 + 1 · Published 2021-06-25 · Updated 2021-09-14 · CVE-2021-35501

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: PandoraFMS versions prior to 7.55

Description: The issue allows for Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS payload will be executed.

Recommendations: For PandoraFMS versions prior to 7.55, update to version 7.55 or later to resolve the issue. As a temporary workaround, consider restricting access to the visual console to minimize the risk of exploitation. Avoid using the name field in the visual console until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-35501

Affected Products

Pandora Fms

References · 5

• 🔥 http://packetstormsecurity.com/files/163466/Pandora-FMS-7.54-Cross-Site-Scripting.html · Exploit
• 🔥 https://k4m1ll0.com/cve-pandorafms754-chained-xss-rce.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-35501 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35501 · Security Note
• https://t.me/cibsecurity/25714 · Telegram Post