CVE-2023-41786 Database backups availability by low-privileged users

What is CVE-2023-41786?

CVE-2023-41786 is a medium-severity vulnerability in Artica Pandora Fms, published on 23 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pandora FMS on all allows File Discovery. This vulnerability allows users with low privileges to download database backups. This issue affects Pandora FMS: from 700 through 772.

Weakness: CWE-668, CWE-200

Which versions are affected by CVE-2023-41786?

It affects 1 product.

Products include Artica Pandora Fms.

How do I fix CVE-2023-41786?

No fix has been published for CVE-2023-41786 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-41786 being exploited?

There is no known exploitation of CVE-2023-41786 in the wild and no public exploit code.

Other vulnerabilities in Artica Pandora Fms

• CVE-2010-4279 Auth bypass in n/a Critical 10.0
• CVE-2021-32098 Deserialization in n/a Critical 9.8
• CVE-2021-32099 SQL injection in n/a Critical 9.8
• CVE-2020-26518 SQL injection in n/a Critical 9.8
• CVE-2018-11221 File upload in n/a Critical 9.8

All Artica Pandora Fms vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5r2x-44qw-g2h7.