PT-2022-12896 · Unknown · Pandora Fms

Published 2022-08-05 · Updated 2022-08-07 · CVE-2021-46676

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pandora FMS versions 756 and below

Description A XSS issue exists that allows an attacker to perform javascript code executions via the transactional maps name field. This enables the execution of malicious scripts.

Recommendations For Pandora FMS versions 756 and below, update to a version above 756 to resolve the issue. As a temporary workaround, consider restricting access to the transactional maps name field to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-46676

Affected Products

Pandora Fms

References · 5

• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46676 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46676 · Vendor Advisory
• https://t.me/cibsecurity/47657 · Telegram Post
• https://incibe.es/en/cve-assignment-publication/coordinated-cves · Note