Vulnerability · Published Jul 26, 2022 · Assigned by INCIBE
CVE-2022-1648Relative Path Traversal to Remote Code Execution in File Manager
Medium 5.7
In plain English
A medium-severity security flaw in Pandora FMS from Artica PFMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).
Severity (CVSS 3.1)5.7Medium
Exploit odds (30 days)1.4%top 27.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images directory which is restricted to execute the .php file. The impact could lead to a Remote Code Execution with running application privilege.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Artica PFMS | Pandora FMS | v760 – through v760 |
Weakness: CWE-23 · Vector: CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
References
- https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ x_refsource_CONFIRM
- https://www.incibe.es/en/cve-assignment-publication/coordinated-cves x_refsource_CONFIRM