Vulnerability · Published Jan 27, 2023 · Assigned by INCIBE

CVE-2022-43979Path Traversal leading to Local File Inclusion

Medium 5.9

In plain English

A medium-severity unrestricted file upload in Pandora FMS from Artica PFMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.8%top 42.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted does not contain malicious characteres, but this check is insufficient. An attacker could insert an absolute path to overcome the heck, thus being able to incluse any PHP file that resides on the disk. The exploitation of this vulnerability could lead to a remote code execution.

Affected products (as reported)

Vendor	Product	Versions
Artica PFMS	Pandora FMS	v764 – through v764

Weakness: CWE-434 · Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/