CVE-2022-1648

moderate-risk
Published 2022-07-26

Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images directory which is restricted to execute the .php file. The impact could lead to a Remote Code Execution with running application privilege.

Do I need to act?

~
2.8% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.7/10 Medium
PHYSICAL / LOW complexity

Affected Products (1)

Affected Vendors

Pandorafms

References (4)

Vendor Advisory https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
Third Party Advisory https://www.incibe.es/en/cve-assignment-publication/coordinated-cves
Vendor Advisory https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
Third Party Advisory https://www.incibe.es/en/cve-assignment-publication/coordinated-cves
30
/ 100
moderate-risk
Severity 19/34 · Moderate
Exploitability 6/34 · Minimal
Exposure 5/34 · Minimal