Design/Logic Flaw

2018-06-1601:29:00

PRIOn knowledge base

www.prio-n.com

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.4%

JSON

XSS in Artica Pandora FMS before 7.0 NG 723 allows an attacker to execute arbitrary code via a crafted “refr” parameter in a “/pandora_console/index.php?sec=estado&sec2=operation/agentes/estado_agente&refr=” call.

CPENameOperatorVersion
artica_pandora_fmseq< 7.0ng723

CPE	Name	Operator	Version
	artica_pandora_fms	eq	< 7.0ng723

References

blog.hackercat.ninja/post/pandoras_box/

pandorafms.com/wp-content/uploads/2018/06/whats-new-723-EN.pdf