Paper/Archive/CVE-2023-44092

CVE-2023-44092

Pandora FMS Pandora FMS — OS Command Injection

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 58.0.580 × 2011.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Pandora FMS on all allows OS Command Injection. This vulnerability allowed to create a reverse shell and execute commands in the OS. This issue affects Pandora FMS: from 700 through <776.

Affected

ProductAffectedFixed inSource

Pandora FMS700 – <776–CNA

pandora_fms700 – < 776776CISA-ADP

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

PandoraFMS (CNA)7.6CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorypandorafms.com/en/security/common-vulnerabilities-and-exposures