CVE-2023-24516
Assigner: INCIBE
Published: 2023-08-22T13:03:39.181Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: All
product: Pandora FMS
vendor: Artica PFMS
versions: lessThanOrEqual: v767
status: affected
version: v0
versionType: custom
datePublic: 2023-02-22T11:25:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: Cross-site Scripting (XSS) vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal  the session cookie value of admin users easily with little user interaction. This issue affects Pandora FMS v767 version and prior versions on all platforms.
value: Cross-site Scripting (XSS) vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal  the session cookie value of admin users easily with little user interaction. This issue affects Pandora FMS v767 version and prior versions on all platforms.
impacts: capecId: CAPEC-592
descriptions: value: CAPEC-592 Stored XSS
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Fixed in v769<br>
value: Fixed in v769

source: discovery: EXTERNAL
title: Stored Cross Site Scripting - Special Days Module
x_generator: engine: Vulnogram 0.1.0-dev