CVE-2022-26308
Assigner: ARTICA
Published: 2022-05-13T00:00:00
State: PUBLISHED
affected: platforms: all
product: Pandora FMS
vendor: Artica PFMS
versions: lessThanOrEqual: v760
status: affected
version: v760
versionType: custom
datePublic: 2022-05-13T00:00:00
descriptions: value: Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could create, delete, view existing keys which are outside the intended role.
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-284
description: CWE-284 Improper Access Control
type: CWE
solutions: value: Fixed in v761
source: defect: 4844
discovery: EXTERNAL
title: Improper Access Control in Configuration (Credential store) 
x_generator: engine: Vulnogram 0.0.9