PT-2022-17776 · Unknown · Pandora Fms

Published 2022-08-01 · Updated 2022-08-05 · CVE-2022-26308

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pandora FMS versions 7.0NG.760 and below

Description The issue allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could create, delete, view existing keys which are outside the intended role.

Recommendations For Pandora FMS versions 7.0NG.760 and below, consider restricting the role of Operator (Write) to prevent unauthorized access to the Credential store until a patch is available. As a temporary workaround, limit the permissions of users with the Operator (Write) role to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2022-26308

Affected Products

Pandora Fms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-26308 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26308 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-26308 · Security Note
• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-26308 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-26308 · Vendor Advisory
• https://t.me/cvenotify/34328 · Telegram Post
• https://incibe.es/en/cve-assignment-publication/coordinated-cves · Note
• https://t.me/cibsecurity/47320 · Telegram Post