PT-2025-24699 · Unknown · Pandora Itsm

H00Die-Gr3Y · Published 2025-06-10 · Updated 2025-06-10 · CVE-2025-4653

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:M/U:Green

Name of the Vulnerable Software and Affected Versions Pandora ITSM version 5.0.105

Description The issue is related to the improper neutralization of special elements in the backup name field, which may allow OS command injection.

Recommendations For Pandora ITSM version 5.0.105, update to a version that fixes the improper neutralization of special elements in the backup name field to prevent OS command injection.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-4653

Affected Products

Pandora Itsm

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-4653 · Security Note
• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures · Note
• https://twitter.com/CVEnew/status/1932472793175658961 · Twitter Post