CVE-2020-11749
moderate-risk
Published 2020-07-13
Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator scanning a SNMP device can trigger a Cross Site Scripting (XSS), which can run arbitrary code to allow Remote Code Execution as root or apache2.
Do I need to act?
~
5.8% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.0/10
Critical
NETWORK
/ LOW complexity
Affected Products (1)
Affected Vendors
References (8)
Release Notes
https://pandorafms.com/downloads/whats-new-747-EN.pdf
Release Notes
https://pandorafms.com/downloads/whats-new-747-EN.pdf
44
/ 100
moderate-risk
Severity
30/34 · Critical
Exploitability
9/34 · Low
Exposure
5/34 · Minimal