CVE-2010-4282 Path traversal in n/a
Remote attackers can exploit directory traversal flaws in Pandora FMS to include and execute arbitrary local files, leading to code execution and data manipulation.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2010-4282?
CVE-2010-4282 is a high-severity path traversal vulnerability in Artica Pandora Fms, published on 2 Dec 2010. It can be exploited over the network, with no action from the victim.
Official description
Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php.
Weakness: CWE-22
Which versions are affected by CVE-2010-4282?
It affects 1 product.
Products include Artica Pandora Fms.
How do I fix CVE-2010-4282?
No fix has been published for CVE-2010-4282 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2010-4282 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-4282 exists.
Public exploit code: 1 Exploit-DB entry and 1 Nuclei template.
Other vulnerabilities in Artica Pandora Fms
Sources
Also known as GHSA-j92f-xw2p-xfrr.