Vulnerability · Published Jul 13, 2020 · Assigned by mitre

CVE-2020-11749

Critical 9.0

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 16.2% (higher than 97% of all known vulnerabilities).

Severity (CVSS NVD)9.0Critical

Exploit odds (30 days)16.2%top 3.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator scanning a SNMP device can trigger a Cross Site Scripting (XSS), which can run arbitrary code to allow Remote Code Execution as root or apache2.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://pandorafms.com/downloads/whats-new-747-EN.pdf x_refsource_CONFIRM
https://medium.com/%40tehwinsam/multiple-xss-on-pandorafms-7-0-ng-744-64b244b8523c x_refsource_MISC
https://packetstormsecurity.com/files/158389/Pandora-FMS-7.0-NG-746-Script-Insertion-Code-Execution.htmlPoC x_refsource_MISC
https://www.exploit-db.com/exploits/48707 x_refsource_MISC