Vulnerability · Published Aug 22, 2023 · Assigned by INCIBE

CVE-2023-24515Server side request forgery in api checker

Medium 5.2

In plain English

A medium-severity server-side request forgery in Pandora FMS from Artica PFMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)5.2Medium

Exploit odds (30 days)0.4%top 61.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Server-Side Request Forgery (SSRF) vulnerability in API checker of Pandora FMS. Application does not have a check on the URL scheme used while retrieving API URL. Rather than validating the http/https scheme, the application allows other scheme such as file, which could allow a malicious user to fetch internal file content. This issue affects Pandora FMS v767 version and prior versions on all platforms.

Affected products (as reported)

Vendor	Product	Versions
Artica PFMS	Pandora FMS	v0 – through v767

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ vendor-advisory
https://gist.github.com/damodarnaik/9cc76c6b320510c34a0a668bd7439f7b related