Vulnerability · Published May 7, 2021 · Assigned by mitre
CVE-2021-32099
Critical 9.8
In plain English
A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 12.7% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)12.7%top 3.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session via the /include/chart_generator.php session_id parameter, leading to a login bypass.
Affected products (as reported)
References
- https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained x_refsource_MISC
- https://pandorafms.com/blog/whats-new-in-pandora-fms-743/ x_refsource_MISC
- https://portswigger.net/daily-swig/multiple-vulnerabilities-in-pandora-fms-could-trigger-remote-execution-attack x_refsource_MISC