Vulnerability · Published Mar 9, 2022 · Assigned by ARTICA
CVE-2022-0507Vulnerability: Authenticated SQL Injection in API
Medium 5.8
In plain English
A medium-severity SQL injection in Pandora FMS from Artica PFMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Severity (CVSS 3.1)5.8Medium
Exploit odds (30 days)1.2%top 30.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Found a potential security vulnerability inside the Pandora API. Affected Pandora FMS version range: all versions of NG version, up to OUM 759. This vulnerability could allow an attacker with authenticated IP to inject SQL.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Artica PFMS | Pandora FMS | v759 – before v759 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
References
- https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ x_refsource_CONFIRM
- https://www.incibe.es/en/cve-assignment-publication/coordinated-cves x_refsource_CONFIRM
- https://khoori.org/posts/cve-2022-0507/ x_refsource_MISC