cve-2022-26310
Vulnerability from cvelistv5
Published
2022-08-01 12:45
Modified
2024-09-16 16:39
Severity ?
7.3 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Summary
Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin user.
References
security@pandorafms.comhttps://pandorafms.com/en/security/common-vulnerabilities-and-exposures/Vendor Advisory
security@pandorafms.comhttps://www.incibe.es/en/cve-assignment-publication/coordinated-cvesThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.incibe.es/en/cve-assignment-publication/coordinated-cvesThird Party Advisory
Impacted products
Vendor Product Version
Artica PFMS Pandora FMS Version: v760   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:03:31.139Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.incibe.es/en/cve-assignment-publication/coordinated-cves"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "all"
          ],
          "product": "Pandora FMS",
          "vendor": "Artica PFMS",
          "versions": [
            {
              "lessThanOrEqual": "v760",
              "status": "affected",
              "version": "v760",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2022-05-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin user."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-01T12:45:01",
        "orgId": "63375d6c-d89a-45ed-8ecc-c8c361b0e04c",
        "shortName": "ARTICA"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.incibe.es/en/cve-assignment-publication/coordinated-cves"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Fixed in v761"
        }
      ],
      "source": {
        "defect": [
          "Ticket#4847"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Improper Authorization in User Management to Vertical Privilege Escalation",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@pandorafms.com",
          "DATE_PUBLIC": "2022-05-13T08:00:00.000Z",
          "ID": "CVE-2022-26310",
          "STATE": "PUBLIC",
          "TITLE": "Improper Authorization in User Management to Vertical Privilege Escalation"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Pandora FMS",
                      "version": {
                        "version_data": [
                          {
                            "platform": "all",
                            "version_affected": "\u003c=",
                            "version_name": "v760",
                            "version_value": "v760"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Artica PFMS"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin user."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285 Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/",
              "refsource": "CONFIRM",
              "url": "https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/"
            },
            {
              "name": "https://www.incibe.es/en/cve-assignment-publication/coordinated-cves",
              "refsource": "CONFIRM",
              "url": "https://www.incibe.es/en/cve-assignment-publication/coordinated-cves"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Fixed in v761"
          }
        ],
        "source": {
          "defect": [
            "Ticket#4847"
          ],
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "63375d6c-d89a-45ed-8ecc-c8c361b0e04c",
    "assignerShortName": "ARTICA",
    "cveId": "CVE-2022-26310",
    "datePublished": "2022-08-01T12:45:01.167736Z",
    "dateReserved": "2022-02-28T00:00:00",
    "dateUpdated": "2024-09-16T16:39:05.916Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-26310\",\"sourceIdentifier\":\"security@pandorafms.com\",\"published\":\"2022-08-01T13:15:10.390\",\"lastModified\":\"2024-11-21T06:53:44.027\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin user.\"},{\"lang\":\"es\",\"value\":\"Pandora FMS versi\u00f3n v7.0NG.760 y anteriores, permite una autorizaci\u00f3n inapropiada en la administraci\u00f3n de usuarios donde cualquier usuario autenticado con acceso al m\u00f3dulo de administraci\u00f3n de usuarios podr\u00eda crear, modificar o eliminar cualquier usuario con privilegio de administrador completo. El impacto podr\u00eda conllevar a una escalada vertical de privilegios para acceder a los privilegios de un usuario de nivel superior o t\u00edpicamente un usuario administrador\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@pandorafms.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.1,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@pandorafms.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:pandorafms:pandora_fms:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"7.0_ng_760\",\"matchCriteriaId\":\"F9ACE0CF-C204-470A-B706-969837339CDC\"}]}]}],\"references\":[{\"url\":\"https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/\",\"source\":\"security@pandorafms.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.incibe.es/en/cve-assignment-publication/coordinated-cves\",\"source\":\"security@pandorafms.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.incibe.es/en/cve-assignment-publication/coordinated-cves\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.