CVE-2010-4282

high · 7.5

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php.

7.5

CVSS

19.6%

EPSS (exploit prob.)

97th

EPSS percentile

2010-12-02

Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
artica	pandora_fms	<= 3.1
artica	pandora_fms	1.2
artica	pandora_fms	1.3
artica	pandora_fms	1.3
artica	pandora_fms	1.3
artica	pandora_fms	1.3
artica	pandora_fms	1.3
artica	pandora_fms	1.3.1
artica	pandora_fms	2.0
artica	pandora_fms	2.0
artica	pandora_fms	2.1
artica	pandora_fms	2.1.1
artica	pandora_fms	3.0
artica	pandora_fms	3.0
artica	pandora_fms	3.0
artica	pandora_fms	3.1

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2010-4282