Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-41792: Cross-Site Request Forgery (CSRF) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in the SNMP Trap Editor. This issu...

CVE-2023-41792 · published 2 years ago

Summary

Cross-Site Request Forgery (CSRF) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in the SNMP Trap Editor. This issue affects Pandora FMS: from 700 through 773.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
artica	pandora_fms	>= 700, <= 773 `cpe:2.3:a:artica:pandora_fms::::::::`

Original advisory text

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-352Cross-Site Request Forgery (CSRF)

Timeline

Published23 Nov 2023

Updated29 Oct 2026

First seen29 Sep 2026

Sources

CVE-2023-41792 · NVD

Track software like this

Free during beta