Artica: >> Pandora Fms >> 7.0 Security Vulnerabilities
Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via include/ajax/update_manager.ajax in the update system.
CVSS Score
9.8
EPSS Score
0.168
Published
2018-06-16
Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.php ajax endpoint.
CVSS Score
7.5
EPSS Score
0.058
Published
2018-06-16
Artica Pandora FMS version 7.0 leaks a full installation pathname via GET data when intercepting the main page's graph requisition. This also implies that general OS information is leaked (e.g., a /var/www pathname typically means Linux or UNIX).
CVSS Score
6.5
EPSS Score
0.003
Published
2017-10-27
Artica Pandora FMS version 7.0 is vulnerable to stored Cross-Site Scripting in the map name parameter.
CVSS Score
5.4
EPSS Score
0.003
Published
2017-10-27
Artica Pandora FMS version 7.0 is vulnerable to remote PHP code execution through the manager files function. This is only exploitable by administrators who upload a PHP file.
CVSS Score
7.2
EPSS Score
0.004
Published
2017-10-27
In Artica Pandora FMS version 7.0, an Attacker with write Permission can create an agent with an XSS Payload; when a user enters the agent definitions page, the script will get executed.
CVSS Score
5.4
EPSS Score
0.003
Published
2017-10-27
Page 2