CVE-2022-47373

Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript payload.

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/Argonx21/CVE-2022-47373	Third Party Advisory
https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/	Vendor Advisory
https://github.com/Argonx21/CVE-2022-47373	Third Party Advisory
https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pandorafms:pandora_fms:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:31

Type	Values Removed	Values Added
References	~~() https://github.com/Argonx21/CVE-2022-47373 - Third Party Advisory~~	() https://github.com/Argonx21/CVE-2022-47373 - Third Party Advisory
References	~~() https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ - Vendor Advisory~~	() https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ - Vendor Advisory
Summary		(es) Cross-Site Scripting reflejado en la funcionalidad de búsqueda de la librería de módulos en la consola de Pandora FMS v766 e inferiores. Esta vulnerabilidad surge en la funcionalidad de olvido de contraseña donde el parámetro nombre de usuario no tiene una validación/sanitización de entrada adecuada, resultando en la ejecución de payload JavaScript malicioso.
CVSS	v2 : ~~unknown~~ v3 : ~~6.1~~	v2 : unknown v3 : 6.4

Information

Published : 2023-02-15 04:15

Updated : 2024-11-21 07:31

NVD link : CVE-2022-47373

Mitre link : CVE-2022-47373

CVE.ORG link : CVE-2022-47373

JSON object : View

Products Affected

pandorafms

pandora_fms

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2022-47373", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2023-02-15T04:15:11.093", "references": [{"url": "https://github.com/Argonx21/CVE-2022-47373", "tags": ["Third Party Advisory"], "source": "cve-coordination@incibe.es"}, {"url": "https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/", "tags": ["Vendor Advisory"], "source": "cve-coordination@incibe.es"}, {"url": "https://github.com/Argonx21/CVE-2022-47373", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-352"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript payload."}, {"lang": "es", "value": "Cross-Site Scripting reflejado en la funcionalidad de b\u00fasqueda de la librer\u00eda de m\u00f3dulos en la consola de Pandora FMS v766 e inferiores. Esta vulnerabilidad surge en la funcionalidad de olvido de contrase\u00f1a donde el par\u00e1metro nombre de usuario no tiene una validaci\u00f3n/sanitizaci\u00f3n de entrada adecuada, resultando en la ejecuci\u00f3n de payload JavaScript malicioso."}], "lastModified": "2024-11-21T07:31:51.007", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pandorafms:pandora_fms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5FC63B93-A766-461F-9877-4D51E1865E84", "versionEndIncluding": "766"}], "operator": "OR"}]}], "sourceIdentifier": "cve-coordination@incibe.es"}