Medium · 5.9 CVE-2023-41792 EUVD-2023-46284GHSA-8mgw-h8q3-3x6m

Lack of Authorization and Stored XSS Via SNMP Trap Editor Page

Published Nov 23, 2023 · Updated Aug 2, 2024 · Assigned by PandoraFMS

Vendor: Pandora FMS Product: Pandora FMS

Description

Cross-Site Request Forgery (CSRF) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in the SNMP Trap Editor. This issue affects Pandora FMS: from 700 through 773.

Affected products

Vendor	Product	Affected	Fixed
Pandora FMS	Pandora FMS	700 – ≤ 773	—

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ vendor-advisory