CVE-2022-47373 : Security Advisory and Response

A detailed overview of the Reflected Cross Site Scripting vulnerability in the Search Functionality of Module Library in Pandora FMS Console v766 and lower.

Understanding CVE-2022-47373

This vulnerability involves a security flaw in the forget password functionality of Pandora FMS Console v766 and lower, allowing the execution of malicious JavaScript payloads.

What is CVE-2022-47373?

The CVE-2022-47373 is a Reflected Cross Site Scripting vulnerability in the Search Functionality of Module Library in Pandora FMS Console v766 and lower. It occurs due to improper input validation/sanitization of the username parameter.

The Impact of CVE-2022-47373

The impact of this vulnerability is rated as MEDIUM severity, with a CVSS base score of 6.4. It can lead to high confidentiality and integrity impacts, making it crucial to address promptly.

Technical Details of CVE-2022-47373

This section provides insights into the vulnerability description, affected systems and versions, as well as the exploitation mechanism.

Vulnerability Description

The vulnerability arises from the lack of proper input validation/sanitization in the forget password functionality, enabling the execution of malicious JavaScript payloads.

Affected Systems and Versions

The vulnerable system is the Pandora FMS Console with versions up to v766. All platforms are susceptible to this issue.

Exploitation Mechanism

Attackers can exploit this vulnerability by injecting and executing malicious JavaScript payloads through the forget password functionality.

Mitigation and Prevention

Discover the immediate steps to take, long-term security practices, and patching and updates recommendations to mitigate the risks associated with CVE-2022-47373.

Immediate Steps to Take

To address CVE-2022-47373, it is essential to apply the fix provided in version v767 of Pandora FMS Console immediately.

Long-Term Security Practices

Implement secure coding practices, conduct regular security assessments, and educate users on safe password management to enhance overall security posture.

Patching and Updates

Stay up to date with patches and security updates released by the vendor to protect the system against potential vulnerabilities.