CVE-2022-43978

There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a login. Since the secret is static in generatePublicHash function, an attacker with knowledge of a valid session can abuse this in order t...

CVE-2022-43978

Pandora FMS vulnerability CVE-2022-43978 affects Pandora FMS version 7.64 (v764). The issue is an improper authentication bypass: the application verifies a valid session when a user is not attempting to log in, due to a static secret in the generatePublicHash function. An attacker who knows a va...

CVE-2022-43978 Limited Authentication bypass due to hardcoded secret

There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a login. Since the secret is static in generatePublicHash function, an attacker with knowledge of a valid session can abuse this in order t...