CVE-2022-47373

Published Feb 15, 2023

Last updated 2 years ago

CVSS medium 6.1

Overview

Description: Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript payload.
Source: cve-coordination@incibe.es
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-79
cve-coordination@incibe.es: CWE-352

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:pandorafms:pandora_fms:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5FC63B93-A766-461F-9877-4D51E1865E84",
            "versionEndIncluding": "766"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References