PT-2023-19663 · Unknown · Pandora Fms

Argonx21 + 1 · Published 2023-08-22 · Updated 2023-11-02 · CVE-2023-24516

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Pandora FMS versions prior to v767

Description A Cross-site Scripting (XSS) issue in the Special Days component allows an attacker to steal the session cookie value of admin users with little user interaction.

Recommendations For versions prior to v767, update to version v767 or later to resolve the issue. As a temporary workaround, consider restricting access to the Special Days component to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-24516

Affected Products

Pandora Fms

References · 4

• 🔥 https://gist.github.com/Argonx21/5ef4d123c975285b3a42835c8e81603a · Exploit
• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24516 · Security Note
• https://osv.dev/vulnerability/CVE-2023-24516 · Vendor Advisory