← Volver a CVEs

CVE-2019-19681

HIGH

8.8

Descripcion

Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and execute commands as root/Administrator. NOTE: The product vendor states that the vulnerability as it is described is not in fact an actual vulnerability. They state that to be able to create alert commands, you need to have admin rights. They also state that the extended ACL system can disable access to specific sections of the configuration, such as defining new alert commands

Detalles CVE

Puntuacion CVSS v3.18.8

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado12/26/2019

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

artica:pandora_fms

Debilidades (CWE)

CWE-863

Referencias

https://k4m1ll0.com/cve-2019-19681.html(cve@mitre.org)

https://medium.com/%40k4m1ll0/remote-code-execution-vulnerability-in-pandorafms-7-x-8ce55d4b1d5a(cve@mitre.org)

https://pandorafms.com/blog/pandora-fms-vulnerability/(cve@mitre.org)

https://k4m1ll0.com/cve-2019-19681.html(af854a3a-2127-422b-91ae-364da2661108)

https://medium.com/%40k4m1ll0/remote-code-execution-vulnerability-in-pandorafms-7-x-8ce55d4b1d5a(af854a3a-2127-422b-91ae-364da2661108)

https://pandorafms.com/blog/pandora-fms-vulnerability/(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.