CVE-2022-43980 MEDIUM

CVE-2022-43980: Cross-site scripting vulnerability in the network maps edit functionality

Vendor Artica Pfms
Product Pandora FMS
Weakness CWE-352 · CSRF
Published January 27, 2023
Last update March 27, 2025

CVSS base score

5.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N

What the vulnerability does

01Description

There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin privileges clicks on the edited network maps, the XSS payload will be executed. The exploitation of this vulnerability could allow an atacker to steal the value of the admin user´s cookie.

Key dates

02Disclosure timeline

January 27, 2023 CVE published
March 27, 2025 Record updated

Related vulnerabilities

04Related CVE