CVE-2023-41789 Unauthenticated Admin Account Takeover Via XSS

High 7.6 Published 23 Nov 2023 Updated 2 Aug 2024

An attacker can hijack admin cookies via XSS to take over accounts without credentials in Pandora FMS.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-41789?

CVE-2023-41789 is a high-severity cross-site scripting vulnerability in Artica Pandora Fms, published on 23 Nov 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allows an attacker to perform cookie hijacking and log in as that user without the need for credentials. This issue affects Pandora FMS: from 700 through 773.

Weakness: CWE-79

Which versions are affected by CVE-2023-41789?

It affects 1 product.

Products include Artica Pandora Fms.

How do I fix CVE-2023-41789?

No fix has been published for CVE-2023-41789 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-41789 being exploited?

There is no known exploitation of CVE-2023-41789 in the wild and no public exploit code.

All Artica Pandora Fms vulnerabilities

Sources

Also known as GHSA-83p7-5pv3-jjx5.