CVE-2023-44091
Assigner: PandoraFMS
Published: 2024-03-19T16:31:38.932Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: all
product: Pandora FMS
vendor: Pandora FMS
versions: lessThanOrEqual: <776
status: affected
version: 700
versionType: custom
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Aleksey Solovev (Positive Technologies)
datePublic: 2024-03-19T17:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection.&nbsp;This ulnerability allowed SQL injections to be made even if authentication failed.<span style="background-color: var(--darkreader-bg--wht);">This issue affects Pandora FMS: from 700 through &lt;776.</span>
value: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. This ulnerability allowed SQL injections to be made even if authentication failed.This issue affects Pandora FMS: from 700 through <776.
impacts: capecId: CAPEC-66
descriptions: value: CAPEC-66 SQL Injection
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 

Fixed in v776.

<br>
value: 
Fixed in v776.


source: discovery: EXTERNAL
title: Unauth Time-Based SQL Injection
x_generator: engine: Vulnogram 0.1.0-dev