CVE-2022-47373 - OpenCVE

Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript payload.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Pandorafms	Pandora Fms

Configuration 1 [-]

cpe:2.3:a:pandorafms:pandora_fms:*:*:*:*:*:*:*:*

References

Link	Resource
https://github.com/Argonx21/CVE-2022-47373	Third Party Advisory
https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: INCIBE

Published: 2023-02-15T00:00:00

Updated: 2023-02-21T00:00:00

Reserved: 2022-12-13T00:00:00

Link: CVE-2022-47373

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-02-15T04:15:11.093

Modified: 2023-02-23T19:30:07.800

Link: CVE-2022-47373

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pandorafms:pandora_fms:*:*:*:*:*:*:*:*", "matchCriteriaId": "5FC63B93-A766-461F-9877-4D51E1865E84", "versionEndIncluding": "766", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript payload."}, {"lang": "es", "value": "Cross-Site Scripting reflejado en la funcionalidad de b\u00fasqueda de la librer\u00eda de m\u00f3dulos en la consola de Pandora FMS v766 e inferiores. Esta vulnerabilidad surge en la funcionalidad de olvido de contrase\u00f1a donde el par\u00e1metro nombre de usuario no tiene una validaci\u00f3n/sanitizaci\u00f3n de entrada adecuada, resultando en la ejecuci\u00f3n de payload JavaScript malicioso."}], "id": "CVE-2022-47373", "lastModified": "2023-02-23T19:30:07.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.5, "source": "cve-coordination@incibe.es", "type": "Secondary"}]}, "published": "2023-02-15T04:15:11.093", "references": [{"source": "cve-coordination@incibe.es", "tags": ["Third Party Advisory"], "url": "https://github.com/Argonx21/CVE-2022-47373"}, {"source": "cve-coordination@incibe.es", "tags": ["Vendor Advisory"], "url": "https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/"}], "sourceIdentifier": "cve-coordination@incibe.es", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-352"}], "source": "cve-coordination@incibe.es", "type": "Secondary"}]}