CVE-2022-47373

2023-02-1504:15:11

CWE-352

CWE-79

[email protected]

web.nvd.nist.gov

cve-2022-47373

reflected cross site scripting

search functionality

pandora fms console

security vulnerability

6.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L

0.0005 Low

EPSS

Percentile

16.4%

JSON

Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript payload.

Affected configurations

Vulners

NVD

Node

pandorafmspandora_fmsRange≤v766

CPENameOperatorVersion
pandorafms:pandora_fmspandorafms pandora fmsle766

CPE	Name	Operator	Version
pandorafms:pandora_fms	pandorafms pandora fms	le	766

CNA Affected

[
  {
    "vendor": "Artica PFMS",
    "product": "Pandora FMS",
    "versions": [
      {
        "version": "v766",
        "status": "affected",
        "lessThanOrEqual": "v766",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "all"
    ]
  }
]