Vulnerability · Published Aug 22, 2023 · Assigned by INCIBE
CVE-2023-24517Remote Code Execution via Unrestricted File Upload
Medium 6.4
In plain English
A medium-severity unrestricted file upload in Pandora FMS from Artica PFMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)1.0%top 38.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue ( unrestricted file upload ) to execute arbitrary system commands. This issue affects Pandora FMS v767 version and prior versions on all platforms.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Artica PFMS | Pandora FMS | v0 – through v767 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L