CVE-2022-43980 Cross-site scripting vulnerability in the network maps edit functionality
Stored XSS in Pandora FMS network maps allows attackers to steal admin cookies by tricking admins into viewing malicious map names.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-43980?
CVE-2022-43980 is a medium-severity cross-site scripting vulnerability in Artica PFMS Pandora FMS, published on 27 Jan 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin privileges clicks on the edited network maps, the XSS payload will be executed. The exploitation of this vulnerability could allow an atacker to steal the value of the admin user´s cookie.
Which versions are affected by CVE-2022-43980?
It affects 1 product.
Products include Pandorafms Pandora Fms.
How do I fix CVE-2022-43980?
No fix has been published for CVE-2022-43980 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-43980 being exploited?
There is no known exploitation of CVE-2022-43980 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Artica PFMS Pandora FMS
Sources
Also known as GHSA-c9jf-g47r-97q7.