PT-2022-17779 · Unknown · Pandora Fms

Published 2022-08-01 · Updated 2022-08-05 · CVE-2022-26310

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pandora FMS versions 7.0NG.760 and below

Description The issue allows an improper authorization in User Management, where any authenticated user with access to the User Management module could create, modify, or delete any user with full admin privilege. This could lead to a vertical privilege escalation, allowing access to the privileges of a higher-level user or typically an admin user.

Recommendations For Pandora FMS versions 7.0NG.760 and below, consider restricting access to the User Management module to prevent unauthorized modifications to user privileges until a fix is available. As a temporary workaround, limit the capabilities of users with access to the User Management module to minimize the risk of exploitation.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2022-26310

Affected Products

Pandora Fms

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-26310 · Security Note
• https://ubuntu.com/security/CVE-2022-26310 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-26310 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-26310 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26310 · Vendor Advisory
• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures · Vendor Advisory
• https://t.me/cvenotify/34325 · Telegram Post
• https://incibe.es/en/cve-assignment-publication/coordinated-cves · Note