CVE-2010-4282

EPSS 19.5%

Vexday Risk Score

43Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 19.5%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

30 Nov 2010Public PoC

02 Dec 2010Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/15643unverified exploitdbwww.exploit-db.com/exploits/15643unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://osvdb.org/69543 http://osvdb.org/69544 http://osvdb.org/69545 http://seclists.org/fulldisclosure/2010/Nov/326 http://secunia.com/advisories/42347 http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download http://www.exploit-db.com/exploits/15643 http://www.securityfocus.com/archive/1/514939/100/0/threaded http://www.securityfocus.com/bid/45112