CVE-2022-45436

Published: Feb 15, 2023Modified: Nov 21, 2024

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). As a manager privilege user , create a network map containing name as xss payload. Once created, admin user must click on the edit network maps and XSS payload will be executed, which could be used for stealing admin users cookie value.

Affected (1)

Products: Pandorafms: Pandora Fms

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pandorafms Pandora Fms	Version 765

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://gist.github.com/damodarnaik/ac07a179972cd4d508f246e9bc5500e7

Source: cve-coordination@incibe.es

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/

Source: cve-coordination@incibe.es

Vendor Advisory

https://gist.github.com/damodarnaik/ac07a179972cd4d508f246e9bc5500e7

Source: af854a3a-2127-422b-91ae-364da2661108

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.