« Volver al listado

CVE-2010-4282

Estado: ModificadaAlta (7.5)—💥 Exploit

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Artica — Pandora FMS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-4282",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-12-02T17:15:00.597",
  "references": [
    {
      "url": "http://osvdb.org/69543",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/69544",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/69545",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2010/Nov/326",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/42347",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/15643",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/514939/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/45112",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/69543",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/69544",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/69545",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2010/Nov/326",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/42347",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/15643",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/514939/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/45112",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de salto de directorio en FMS anterior a v3.1.1 permite a atacantes remotos incluir y ejecutar ficheros locales de su elección mediante (1) el parámetro page para ajax.php o (2) el parámetro id para general/pandora_help.php, y permite a atacantes remotos incluir, ejecutar, crear, modificar, o borrar ficheros locales de su elección mediante (3) el parámetro layout para operation/agentes/networkmap.php."
    }
  ],
  "lastModified": "2026-06-16T23:24:30.327",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:artica:pandora_fms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A972A8C1-4418-457A-B333-31CBFEA87F43",
              "versionEndIncluding": "3.1"
            },
            {
              "criteria": "cpe:2.3:a:artica:pandora_fms:1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5F58083-665E-40CE-94E8-AF46BD41E2B1"
            },
            {
              "criteria": "cpe:2.3:a:artica:pandora_fms:1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C4153C42-C38B-4DF8-9C24-2060FB18F370"
            },
            {
              "criteria": "cpe:2.3:a:artica:pandora_fms:1.3:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2544AF2E-0BA3-409F-9AF4-7B42751C8E56"
            },
            {
              "criteria": "cpe:2.3:a:artica:pandora_fms:1.3:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95734EBF-826B-43B9-B790-111329AB8581"
            },
            {
              "criteria": "cpe:2.3:a:artica:pandora_fms:1.3:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34FB9160-6109-4C68-B8C2-E9FF5FA1E783"
            },
            {
              "criteria": "cpe:2.3:a:artica:pandora_fms:1.3:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7220D9B-1FAB-4265-90D9-87630AE906B0"
            },
            {
              "criteria": "cpe:2.3:a:artica:pandora_fms:1.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F912B082-3834-462C-956E-5003E5CDF624"
            },
            {
              "criteria": "cpe:2.3:a:artica:pandora_fms:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE24C15F-4653-46CB-9C8F-6DE942154B65"
            },
            {
              "criteria": "cpe:2.3:a:artica:pandora_fms:2.0:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1464A86D-222B-49BD-A4F5-9AE5AD57E016"
            },
            {
              "criteria": "cpe:2.3:a:artica:pandora_fms:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CAF92EC0-0616-4F17-9588-70C22C69A579"
            },
            {
              "criteria": "cpe:2.3:a:artica:pandora_fms:2.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69446BEE-365D-49B5-9AEC-268AA93D8E2A"
            },
            {
              "criteria": "cpe:2.3:a:artica:pandora_fms:3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD917088-E151-4EC1-94AE-2D3F2F3A600B"
            },
            {
              "criteria": "cpe:2.3:a:artica:pandora_fms:3.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8BBEA8F8-E1FB-4C62-91FD-67EBD5006F96"
            },
            {
              "criteria": "cpe:2.3:a:artica:pandora_fms:3.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98406056-AD7A-4A54-80B8-280E197F90ED"
            },
            {
              "criteria": "cpe:2.3:a:artica:pandora_fms:3.1:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B32CC8A6-A253-4DD2-867C-DCE583F073E0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}