Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allows attackers to execute code via PHP file uploads. This issue affects Pandora FMS: from 700 through 773.
Metrics
CVSS Version: 3.1 |
Base Score: 7.6 HIGH Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
l➤ Exploitability Metrics: Attack Vector (AV)* NETWORK Attack Complexity (AC)* HIGH Privileges Required (PR)* HIGH User Interaction (UI)* REQUIRED Scope (S)* CHANGED
l➤ Impact Metrics: Confidentiality Impact (C)* HIGH Integrity Impact (I)* HIGH Availability Impact (A)* HIGH
Weakness Enumeration (CWE)
CWE-ID: CWE-434 CWE Name: CWE-434 Unrestricted Upload of File with Dangerous Type Source: Pandora FMS
Common Attack Pattern Enumeration and Classification (CAPEC)
CAPEC-ID: CAPEC-1 CAPEC Description: CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs