CVE-2023-2807
Assigner: INCIBE
Published: 2023-06-13T11:10:59.966Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: All
product: Pandora FMS
vendor: Artica PFMS
versions: lessThanOrEqual: v771
status: affected
version: v0
versionType: custom
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Thanks to Edisc from the VNG security team (edisc.ctf@gmail.com)
datePublic: 2023-06-13T10:25:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset process for any user account without proper authentication. This issue affects PandoraFMS v771 and prior versions on all platforms.
value: Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset process for any user account without proper authentication. This issue affects PandoraFMS v771 and prior versions on all platforms.
impacts: capecId: CAPEC-50
descriptions: value: CAPEC-50 Password Recovery Exploitation
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-290
description: CWE-290 Authentication Bypass by Spoofing
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Fixed in v772<br>
value: Fixed in v772

source: discovery: EXTERNAL
title: Authentication bypass in password reset process
x_generator: engine: Vulnogram 0.1.0-dev