PT-2023-28094 · Unknown · Pandora Fms

Published 2023-11-23 · Updated 2024-01-09 · CVE-2023-41791

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions Pandora FMS versions 700 through 773

Description The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting (XSS). This allows users with low privileges to introduce Javascript executables via a translation string, potentially affecting the integrity of some configuration files.

Recommendations For Pandora FMS versions 700 through 773, update to a version that includes a fix for this issue to prevent Cross-site Scripting (XSS) attacks. As a temporary workaround, consider restricting access to translation strings to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-41791

Affected Products

Pandora Fms

References · 5

• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41791 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41791 · Security Note
• https://t.me/cvenotify/61048 · Telegram Post
• https://t.me/true_secator/5271 · Telegram Post