CVE-2024-35308 Post-auth Arbitrary File Read in the Server Plugins Section

Q: Is CVE-2024-35308 being exploited?

There is no known exploitation of CVE-2024-35308 in the wild and no public exploit code.

Q: How do I fix CVE-2024-35308?

No fix has been published for CVE-2024-35308 yet. Limit exposure of the affected software until one is available.

High 8.3 Published 22 Oct 2024 Updated 22 Oct 2024

An authenticated attacker can read arbitrary files from the server via the plugins section in Pandora FMS.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-35308?

CVE-2024-35308 is a high-severity path traversal vulnerability in Pandora FMS, published on 22 Oct 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 through <777.3.

Weakness: CWE-22

Which versions are affected by CVE-2024-35308?

It affects 1 product.

Products include Pandorafms Pandora Fms.

How do I fix CVE-2024-35308?

No fix has been published for CVE-2024-35308 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-35308 being exploited?

There is no known exploitation of CVE-2024-35308 in the wild and no public exploit code.

Sources

Also known as GHSA-3p5c-4j36-fmjf.