CVE-2019-19681

** DISPUTED ** Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and execute commands as root/Administrator. NOTE: The product vendor states that the vulnerability as it is described is not in fact an actual vulnerability. They state that to be able to create alert commands, you need to have admin rights. They also state that the extended ACL system can disable access to specific sections of the configuration, such as defining new alert commands.

CVSS v3 8.8 HIGH
CVSS v2.0 9.0 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://k4m1ll0.com/cve-2019-19681.html
https://medium.com/%40k4m1ll0/remote-code-execution-vulnerability-in-pandorafms-7-x-8ce55d4b1d5a
https://pandorafms.com/blog/pandora-fms-vulnerability/

Configurations

Configuration 1 (hide)

cpe:2.3:a:artica:pandora_fms:7.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-12-26 16:15

Updated : 2024-08-05 03:15

NVD link : CVE-2019-19681

Mitre link : CVE-2019-19681

CVE.ORG link : CVE-2019-19681

JSON object : View

Products Affected

artica

pandora_fms

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2019-19681", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2019-12-26T16:15:10.857", "references": [{"url": "https://k4m1ll0.com/cve-2019-19681.html", "source": "cve@mitre.org"}, {"url": "https://medium.com/%40k4m1ll0/remote-code-execution-vulnerability-in-pandorafms-7-x-8ce55d4b1d5a", "source": "cve@mitre.org"}, {"url": "https://pandorafms.com/blog/pandora-fms-vulnerability/", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and execute commands as root/Administrator. NOTE: The product vendor states that the vulnerability as it is described is not in fact an actual vulnerability. They state that to be able to create alert commands, you need to have admin rights. They also state that the extended ACL system can disable access to specific sections of the configuration, such as defining new alert commands"}, {"lang": "es", "value": "** EN DISPUTA ** Pandora FMS 7.x sufre de vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo. Con un usuario autenticado que puede modificar el sistema de alerta, es posible definir y ejecutar comandos como root / Administrador. NOTA: El proveedor del producto afirma que la vulnerabilidad tal como se describe no es en realidad una vulnerabilidad real. Afirman que para poder crear comandos de alerta, debe tener derechos de administrador. Tambi\u00e9n afirman que el sistema ACL extendido puede inhabilitar el acceso a secciones espec\u00edficas de la configuraci\u00f3n, como definir nuevos comandos de alerta."}], "lastModified": "2024-08-05T03:15:34.433", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:artica:pandora_fms:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60CEE4B3-B2D2-4823-B626-214B2ED406DE"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}