CVE-2022-47373 Vulnerability Details

  /     /     /  

CVE-2022-47373 Metadata Quick Info

CVE Published: 15/02/2023 | CVE Updated: 03/08/2024 | CVE Year: 2022
Source: INCIBE | Vendor: Artica PFMS | Product: Pandora FMS
Status : PUBLISHED

---

CVE-2022-47373 Description

Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript payload.

Metrics

CVSS Version: 3.1 | Base Score: 6.4 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* HIGH
    User Interaction (UI)* REQUIRED
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* LOW

Weakness Enumeration (CWE)

CWE-ID: CWE-352
CWE Name: CWE-352 Cross-Site Request Forgery (CSRF)
Source: Artica PFMS

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).