« Volver al listado

CVE-2022-26308

Estado: ModificadaMedia (5.4)—

Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could create, delete, view existing keys which are outside the intended role.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pandorafms — Pandora FMS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-26308",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@pandorafms.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@pandorafms.com",
      "affectedData": [
        {
          "vendor": "Artica PFMS",
          "product": "Pandora FMS",
          "versions": [
            {
              "status": "affected",
              "version": "v760",
              "versionType": "custom",
              "lessThanOrEqual": "v760"
            }
          ],
          "platforms": [
            "all"
          ]
        }
      ]
    }
  ],
  "published": "2022-08-01T13:15:10.257",
  "references": [
    {
      "url": "https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@pandorafms.com"
    },
    {
      "url": "https://www.incibe.es/en/cve-assignment-publication/coordinated-cves",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@pandorafms.com"
    },
    {
      "url": "https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.incibe.es/en/cve-assignment-publication/coordinated-cves",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@pandorafms.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could create, delete, view existing keys which are outside the intended role."
    },
    {
      "lang": "es",
      "value": "Pandora FMS versiones v7.0NG.760 y anteriores, permiten un control de acceso inapropiado en la Configuración (Almacén de credenciales) donde un usuario con el rol de Operador (Escritura) podría crear, borrar, visualizar claves existentes que están fuera del rol previsto"
    }
  ],
  "lastModified": "2026-06-17T04:34:57.243",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pandorafms:pandora_fms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9ACE0CF-C204-470A-B706-969837339CDC",
              "versionEndIncluding": "7.0_ng_760"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@pandorafms.com"
}