Vulnerability · Published Oct 22, 2024 · Assigned by PandoraFMS
CVE-2024-35308Post-auth Arbitrary File Read in the Server Plugins Section
High 8.3
In plain English
A high-severity path traversal in Pandora FMS from Pandora FMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 4.0)8.3High
Exploit odds (30 days)0.6%top 50.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 through <777.3.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Pandora FMS | Pandora FMS | 700 – before 777.3 |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Red