PT-2025-24700 · Unknown · Pandora Itsm

H00Die-Gr3Y · CVE-2025-4678 · Published 2025-06-10 · Updated 2025-06-10

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/S:N/AU:N/R:U/V:D/RE:M/U:Green

Name of the Vulnerable Software and Affected Versions Pandora ITSM version 5.0.105

Description The issue is related to the improper neutralization of special elements in the chromium path variable, which may allow OS command injection.

Recommendations For Pandora ITSM version 5.0.105, consider restricting access to the chromium path variable to minimize the risk of OS command injection until a patch is available.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-4678

Affected Products

Pandora Itsm

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-4678 · Security Note
• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures · Note
• https://twitter.com/CVEnew/status/1932472792068378915 · Twitter Post