PT-2023-14665 · Artica · Artica Pandora Fms

Damodar Naik · Published 2023-02-15 · Updated 2023-10-18 · CVE-2022-45436

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Artica PFMS Pandora FMS version v765

Description The issue allows Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. As a manager privilege user, an attacker can create a network map containing a malicious name, which acts as an XSS payload. Once created, if an admin user clicks on the edit network maps, the XSS payload will be executed. This could potentially be used for stealing admin users' cookie values.

Recommendations For Artica PFMS Pandora FMS version v765, as a temporary workaround, consider restricting access to the network map creation feature for manager privilege users until a patch is available. Additionally, restrict the ability to edit network maps for admin users to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-45436

Affected Products

Artica Pandora Fms

References · 8

• https://ubuntu.com/security/CVE-2022-45436 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45436 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-45436 · Security Note
• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-45436 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45436 · Vendor Advisory
• https://t.me/cibsecurity/58214 · Telegram Post
• https://gist.github.com/damodarnaik/ac07a179972cd4d508f246e9bc5500e7 · Note