VulnerabilityModified

CVE-2023-0828

Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers users server.

MEDIUM 6.1EPSS 0.34%

Does this matter?

Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.

Description

Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers users server. This issue affects Pandora FMS v767 version and prior versions on all platforms.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.34% probability · 27th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: pandorafms/pandora fms
Source: cve-coordination@incibe.es

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/Vendor Advisory
https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.