CVE-2021-46678
Assigner: ARTICA
Published: 2022-02-21T00:00:00
State: PUBLISHED
affected: platforms: all
product: Pandora FMS
vendor: Artica PFMS
versions: lessThanOrEqual: v756
status: affected
version: v756
versionType: custom
datePublic: 2022-02-21T00:00:00
descriptions: value: A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the service name field.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
version: 3.1
problemTypes: descriptions: cweId: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
type: CWE
solutions: value: This vulnerability has been solved in the 757 version of Pandora FMS.
source: discovery: INTERNAL
title: Vulnerability XSS in service form name field
x_generator: engine: Vulnogram 0.0.9