CVE-2023-41814 LOW

CVE-2023-41814: XSS Vulnerability Messages

Vendor Pandora Fms
Product Pandora FMS
Weakness CWE-79 · XSS
Published December 29, 2023
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

3.7/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Through an HTML payload (iframe tag) it is possible to carry out XSS attacks when the user receiving the messages opens their notifications. This issue affects Pandora FMS: from 700 through 774.

Key dates

02Disclosure timeline

December 29, 2023 CVE published
August 2, 2024 Record updated