cve-2022-45436
Vulnerability from cvelistv5
Published
2023-02-15 00:00
Modified
2024-08-03 14:09
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). As a manager privilege user , create a network map containing name as xss payload. Once created, admin user must click on the edit network maps and XSS payload will be executed, which could be used for stealing admin users cookie value.
References
cve-coordination@incibe.eshttps://gist.github.com/damodarnaik/ac07a179972cd4d508f246e9bc5500e7
cve-coordination@incibe.eshttps://pandorafms.com/en/security/common-vulnerabilities-and-exposures/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://gist.github.com/damodarnaik/ac07a179972cd4d508f246e9bc5500e7
af854a3a-2127-422b-91ae-364da2661108https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/Vendor Advisory
Impacted products
Vendor Product Version
Artica PFMS Pandora FMS Version: v765
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:09:57.046Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/"
          },
          {
            "tags": [
              "related",
              "x_transferred"
            ],
            "url": "https://gist.github.com/damodarnaik/ac07a179972cd4d508f246e9bc5500e7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "all"
          ],
          "product": "Pandora FMS",
          "vendor": "Artica PFMS",
          "versions": [
            {
              "status": "affected",
              "version": "v765"
            }
          ]
        }
      ],
      "datePublic": "2022-11-15T23:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). As a manager privilege user , create a network map containing name as xss payload. Once created, admin user must click on the edit network maps and XSS payload will be executed, which could be used for stealing admin users cookie value.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). As a manager privilege user , create a network map containing name as xss payload. Once created, admin user must click on the edit network maps and XSS payload will be executed, which could be used for stealing admin users cookie value.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-18T11:06:32.305Z",
        "orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
        "shortName": "INCIBE"
      },
      "references": [
        {
          "url": "https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://gist.github.com/damodarnaik/ac07a179972cd4d508f246e9bc5500e7"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003efixed in v766\u003c/p\u003e"
            }
          ],
          "value": "fixed in v766\n\n"
        }
      ],
      "source": {
        "defect": [
          "2022-45436"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Stored cross-site scripting vulnerability in network maps editor feature",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
    "assignerShortName": "INCIBE",
    "cveId": "CVE-2022-45436",
    "datePublished": "2023-02-15T00:00:00",
    "dateReserved": "2022-11-15T00:00:00",
    "dateUpdated": "2024-08-03T14:09:57.046Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-45436\",\"sourceIdentifier\":\"cve-coordination@incibe.es\",\"published\":\"2023-02-15T04:15:10.613\",\"lastModified\":\"2024-11-21T07:29:15.450\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). As a manager privilege user , create a network map containing name as xss payload. Once created, admin user must click on the edit network maps and XSS payload will be executed, which could be used for stealing admin users cookie value.\\n\\n\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de neutralizaci\u00f3n inadecuada de la entrada durante la generaci\u00f3n de la p\u00e1gina web en Artica PFMS Pandora FMS v765 en todas las plataformas, permite Cross-Site Scripting (XSS). Como usuario con privilegios de administrador, crea un mapa de red que contiene el nombre como payload xss. Una vez creado, el usuario administrador debe hacer clic en la edici\u00f3n de mapas de red y se ejecutar\u00e1 el payload XSS, que podr\u00eda ser utilizado para robar el valor de la cookie de los usuarios administradores.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cve-coordination@incibe.es\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.9,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.7,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"cve-coordination@incibe.es\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:pandorafms:pandora_fms:765:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"09E9C019-B213-42AF-8555-3ACBA24596FD\"}]}]}],\"references\":[{\"url\":\"https://gist.github.com/damodarnaik/ac07a179972cd4d508f246e9bc5500e7\",\"source\":\"cve-coordination@incibe.es\"},{\"url\":\"https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/\",\"source\":\"cve-coordination@incibe.es\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://gist.github.com/damodarnaik/ac07a179972cd4d508f246e9bc5500e7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.