PT-2023-14666 · Artica · Pandora Fms

Damodar Naik · Published 2023-02-15 · Updated 2023-10-18 · CVE-2022-45437

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Artica PFMS Pandora FMS version v765

Description The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting (XSS). A user with edition privileges can create a payload in the reporting dashboard module. An admin user can observe the payload without interaction, and the attacker can obtain information.

Recommendations For version v765, consider disabling the reporting dashboard module until a patch is available to prevent the creation of malicious payloads. Restrict access to the reporting dashboard module to minimize the risk of exploitation. Avoid allowing users with edition privileges to create content in the reporting dashboard module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-45437

Affected Products

Pandora Fms

References · 8

• https://osv.dev/vulnerability/CVE-2022-45437 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45437 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-45437 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45437 · Vendor Advisory
• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-45437 · Security Note
• https://gist.github.com/damodarnaik/06180e8a5aa237b38740486b3e398011 · Note
• https://t.me/cibsecurity/58216 · Telegram Post