CVE-2020-11749

Опубликовано: 13 июл. 2020

Источник: nvd

CVSS3: 9

CVSS2: 8.5

EPSS Низкий

Описание

Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator scanning a SNMP device can trigger a Cross Site Scripting (XSS), which can run arbitrary code to allow Remote Code Execution as root or apache2.

Ссылки

https://medium.com/%40tehwinsam/multiple-xss-on-pandorafms-7-0-ng-744-64b244b8523c
https://packetstormsecurity.com/files/158389/Pandora-FMS-7.0-NG-746-Script-Insertion-Code-Execution.htmlPoC
Exploit
Third Party Advisory
VDB Entry
https://pandorafms.com/downloads/whats-new-747-EN.pdf
Release Notes
Vendor Advisory
https://www.exploit-db.com/exploits/48707
Exploit
Third Party Advisory
VDB Entry
https://medium.com/%40tehwinsam/multiple-xss-on-pandorafms-7-0-ng-744-64b244b8523c
https://packetstormsecurity.com/files/158389/Pandora-FMS-7.0-NG-746-Script-Insertion-Code-Execution.htmlPoC
Exploit
Third Party Advisory
VDB Entry
https://pandorafms.com/downloads/whats-new-747-EN.pdf
Release Notes
Vendor Advisory
https://www.exploit-db.com/exploits/48707
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:pandorafms:pandora_fms:*:*:*:*:*:*:*:*

Версия от 7.0_ng (включая) до 746 (включая)

EPSS

Процентиль: 90%

0.05582

Низкий

9 Critical

CVSS3

8.5 High

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-w3g2-8xhr-cpj2