critical9.0Public exploit code
CVE-2020-11749
Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PandoraFMS 7.0 NG 746 - Persistent Cross-Site Scripting2020-07-26 · webapps · php
Impact
Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator scanning a SNMP device can trigger a Cross Site Scripting (XSS), which can run arbitrary code to allow Remote Code Execution as root or apache2.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pandorafms | Pandora Fms | from 7.0_ng through 746 |
Weakness classification
References
- NVD record
- CVE.org record
- https://medium.com/%40tehwinsam/multiple-xss-on-pandorafms-7-0-ng-744-64b244b8523c
- https://packetstormsecurity.com/files/158389/Pandora-FMS-7.0-NG-746-Script-Insertion-Code-Execution.htmlPoC
- https://pandorafms.com/downloads/whats-new-747-EN.pdf
- https://www.exploit-db.com/exploits/48707
- https://medium.com/%40tehwinsam/multiple-xss-on-pandorafms-7-0-ng-744-64b244b8523c
- https://packetstormsecurity.com/files/158389/Pandora-FMS-7.0-NG-746-Script-Insertion-Code-Execution.htmlPoC
- https://pandorafms.com/downloads/whats-new-747-EN.pdf
- https://www.exploit-db.com/exploits/48707