CVE-2020-13850

Artica Pandora FMS 7.44 has inadequate access controls on a web folder...

CVE-2020-13850

Artica Pandora FMS 7.44 has inadequate access controls on a web folder...

Privilege escalation

Artica Pandora FMS 7.44 allows privilege escalation...

Design/Logic Flaw

Artica Pandora FMS 7.44 has inadequate access controls on a web folder...

Command injection

Artica Pandora FMS 7.44 allows remote command execution via the events feature...

Information disclosure

Artica Pandora FMS 7.44 has persistent XSS in the Messages feature...

CVE-2020-13851

CVE-2020-13851 affects Artica Pandora FMS 7.44, enabling remote command execution via the Events feature. The underlying cause is a command-injection vulnerability in Events that could allow unauthenticated attackers to run arbitrary commands, potentially taking control of the Pandora FMS server ...

CVE-2020-13851

Artica Pandora FMS 7.44 allows remote command execution via the events feature...

CVE-2020-13852

Pandora FMS 7.44 is affected by CVE-2020-13852 due to a flaw in the File Manager that allows uploading a PHP web shell to a restricted directory, enabling remote command execution as the apache user. The accompanying advisory details multiple related vectors (_arbitrary file upload in File Manage...

CVE-2020-13852

Artica Pandora FMS 7.44 allows arbitrary file upload leading to remote command execution via the File Manager feature...

CVE-2020-13853

Pandora FMS 7.44 is affected by CVE-2020-13853, a persistent Cross-Site Scripting (XSS) vulnerability in the Messages feature. The CoreLabs advisory details that an attacker can inject arbitrary JavaScript into messages, which is executed in the recipient’s browser and can facilitate session cook...

CVE-2020-13853

Artica Pandora FMS 7.44 has persistent XSS in the Messages feature...

CVE-2020-13854

Artica Pandora FMS 7.44 allows privilege escalation...

CVE-2020-13854

CVE-2020-13854 affects Pandora FMS (notably 7.44) and enables privilege escalation via the Quick Shell plugin using Gotty running as root. The advisory explains a chain where remote code execution vulnerabilities (e.g., 7.1–7.3) or Web UI flaws grant a low-privilege user a shell on the underlying...

CVE-2020-13855

Pandora FMS 7.44 is affected by CVE-2020-13855 (File Repository Manager) which allows an administrator to upload a PHP web shell to a publicly accessible folder, enabling execution of system commands with the apache user. The vulnerability is demonstrated via an uploaded web shell and subsequent ...

CVE-2020-13855

Artica Pandora FMS 7.44 allows arbitrary file upload leading to remote command execution via the File Repository Manager feature...

CVE-2020-13850

Pandora FMS (Artica Pandora FMS) 7.44 contains an inadequate access control flaw in the Pandora Console web folder (CVE-2020-13850) that enables directory listing and exposure of sensitive files (e.g., logs and uploaded content) via direct URLs such as /pandora_console/*. The CoreLabs advisory do...

CVE-2020-13850

Artica Pandora FMS 7.44 has inadequate access controls on a web folder...

: Pandora FMS Community Multiple Vulnerabilities

1. Advisory Information Title : Pandora FMS Community Multiple Vulnerabilities Advisory ID : CORE-2020-0010 Advisory URL : www.coresecurity.com/core-labs/advisories/pandora-fms-community-multiple-vulnerabilities Date published : 2020-06-09 Date of last update : 2020-06-09 Vendors contacted: Ártic...

Pandora FMS Events Remote Command Execution

This module exploits a vulnerability CVE-2020-13851 in Pandora FMS versions 7.0 NG 742, 7.0 NG 743, and 7.0 NG 744 and perhaps older versions in order to execute arbitrary commands. This module takes advantage of a command injection vulnerability in the Events feature of Pandora FMS. This flaw...