CVE-2023-4677 Vulnerability Details

  /     /     /  

CVE-2023-4677 Metadata Quick Info

CVE Published: 23/11/2023 | CVE Updated: 02/12/2024 | CVE Year: 2023
Source: PandoraFMS | Vendor: Pandora FMS | Product: Pandora FMS
Status : PUBLISHED

---

CVE-2023-4677 Description

Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This issue affects Pandora FMS <= 772.

Metrics

CVSS Version: 3.1 | Base Score: 7 HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* HIGH
    Privileges Required (PR)* NONE
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* LOW
    Availability Impact (A)* LOW

Weakness Enumeration (CWE)

CWE-ID: CWE-287
CWE Name: CWE-287 Improper Authentication
Source: Pandora FMS

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-115
CAPEC Description: CAPEC-115 Authentication Bypass


Source: NVD (National Vulnerability Database).