PT-2024-2986 · Unknown+1 · Pandora Fms+1

[e-mail] · Published 2024-01-10 · Updated 2024-03-20 · CVE-2023-44090

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Pandora FMS versions 700 through 776

Description The issue is related to an SQL Injection vulnerability, which allows for improper neutralization of special elements used in an SQL command. This vulnerability affects the Grafana module, enabling potential changes to several files. The exploitation of this issue may allow a remote attacker to gain unauthorized access to protected information and execute arbitrary SQL code.

Recommendations For versions 700 through 776, update to a version that includes the fix for this SQL Injection vulnerability to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-03166

CVE-2023-44090

Affected Products

Grafana

Pandora Fms

References · 8

• https://bdu.fstec.ru/vul/2024-03166 · Security Note
• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44090 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44090 · Vendor Advisory
• https://vuldb.com/?id.257336 · Note
• https://pandorafms.com/en/release-notes/pandorafms-ng-776-rrr · Note
• https://twitter.com/VulmonFeeds/status/1770160574292164673 · Twitter Post
• https://twitter.com/CVEnew/status/1770128450939998542 · Twitter Post