CVE-2022-43980
Cross-site scripting vulnerability in the network maps edit functionality
- State
- Published
- Severity
- 5.2 Medium
- Published
- Jan 27, 2023
- Updated
- Mar 27, 2025
- Reserved
- Oct 28, 2022
Description
There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin privileges clicks on the edited network maps, the XSS payload will be executed. The exploitation of this vulnerability could allow an atacker to steal the value of the admin user´s cookie.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.2 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N | INCIBE |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
Pandora FMSArtica PFMS |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.