vendor:
Pandora FMS
by:
Unknown
7.5
CVSS
HIGH
Cross-Site Scripting
79
CWE
Product Name: Pandora FMS
Affected Version From: 3.2.2001
Affected Version To: Unknown
Patch Exists: NO
Related CWE: CVE-2011-4577
CPE: pandora_fms
Metasploit:
https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2012-0109/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp2-cve-2011-4577/, https://www.rapid7.com/db/vulnerabilities/hpux-cve-2011-4577/, https://www.rapid7.com/db/vulnerabilities/oracle_linux-cve-2011-4577/, https://www.rapid7.com/db/vulnerabilities/oracle-solaris-cve-2011-4577/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2012-0059/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2011-4577/, https://www.rapid7.com/db/vulnerabilities/apple-osx-openssl-cve-2011-4577/, https://www.rapid7.com/db/vulnerabilities/apple-osx-note-cve-2011-4577/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2011-4577/, https://www.rapid7.com/db/vulnerabilities/hpsmh-cve-2011-4577/, https://www.rapid7.com/db/vulnerabilities/http-openssl-cve-2011-4577/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2011-4577/, https://www.rapid7.com/db/vulnerabilities/vmsa-2012-0013-cve-2011-4577/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2011-0177/
Platforms Tested:
Unknown
Cross-Site Scripting Vulnerability in Pandora FMS
Pandora FMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Mitigation:
To mitigate this vulnerability, it is recommended to sanitize and validate user-supplied data before displaying it on web pages. Implementing proper input validation and output encoding can help prevent cross-site scripting attacks.
