CVE-2022-47373 MEDIUM

CVE-2022-47373: Reflected Cross Site Scripting in Search Functionality of Module Library

Vendor Artica Pfms
Product Pandora FMS
Weakness CWE-352 · CSRF
Published February 15, 2023
Last update April 4, 2025
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L

What the vulnerability does

01Description

Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript payload.

Key dates

02Disclosure timeline

February 15, 2023 CVE published
April 4, 2025 Record updated