2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2010-4279" ,
"sourceIdentifier" : "cve@mitre.org" ,
"published" : "2010-12-02T17:15:00.503" ,
"lastModified" : "2018-10-10T20:07:57.443" ,
"vulnStatus" : "Modified" ,
"descriptions" : [
{
"lang" : "en" ,
"value" : "The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with \"admin\" in the loginhash_user parameter, in conjunction with the md5 hash of \"admin\" in the loginhash_data parameter."
} ,
{
"lang" : "es" ,
"value" : "La configuraci\u00f3n por defecto de Pandora FMS v3.1 y anteriores especifica una cadena vac\u00eda para el campo loginhash_pwd, permitiendo a atacantes remotos evitar la autenticaci\u00f3n mediante el env\u00edo de una solicitud a index.php con \"admin\" en el par\u00e1metro loginhash_user, junto con el el hash md5 de \" admin \"en el par\u00e1metro loginhash_data."
}
] ,
"metrics" : {
"cvssMetricV2" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "2.0" ,
"vectorString" : "AV:N/AC:L/Au:N/C:C/I:C/A:C" ,
"accessVector" : "NETWORK" ,
"accessComplexity" : "LOW" ,
"authentication" : "NONE" ,
"confidentialityImpact" : "COMPLETE" ,
"integrityImpact" : "COMPLETE" ,
"availabilityImpact" : "COMPLETE" ,
"baseScore" : 10.0
} ,
"baseSeverity" : "HIGH" ,
"exploitabilityScore" : 10.0 ,
"impactScore" : 10.0 ,
"acInsufInfo" : false ,
"obtainAllPrivilege" : false ,
"obtainUserPrivilege" : false ,
"obtainOtherPrivilege" : false ,
"userInteractionRequired" : false
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-287"
}
]
}
] ,
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:artica:pandora_fms:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "3.1" ,
"matchCriteriaId" : "A972A8C1-4418-457A-B333-31CBFEA87F43"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:artica:pandora_fms:1.2:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "E5F58083-665E-40CE-94E8-AF46BD41E2B1"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:artica:pandora_fms:1.3:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C4153C42-C38B-4DF8-9C24-2060FB18F370"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:artica:pandora_fms:1.3:beta:*:*:*:*:*:*" ,
"matchCriteriaId" : "2544AF2E-0BA3-409F-9AF4-7B42751C8E56"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:artica:pandora_fms:1.3:beta1:*:*:*:*:*:*" ,
"matchCriteriaId" : "95734EBF-826B-43B9-B790-111329AB8581"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:artica:pandora_fms:1.3:beta2:*:*:*:*:*:*" ,
"matchCriteriaId" : "34FB9160-6109-4C68-B8C2-E9FF5FA1E783"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:artica:pandora_fms:1.3:beta3:*:*:*:*:*:*" ,
"matchCriteriaId" : "A7220D9B-1FAB-4265-90D9-87630AE906B0"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:artica:pandora_fms:1.3.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "F912B082-3834-462C-956E-5003E5CDF624"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:artica:pandora_fms:2.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "EE24C15F-4653-46CB-9C8F-6DE942154B65"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:artica:pandora_fms:2.0:beta:*:*:*:*:*:*" ,
"matchCriteriaId" : "1464A86D-222B-49BD-A4F5-9AE5AD57E016"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:artica:pandora_fms:2.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "CAF92EC0-0616-4F17-9588-70C22C69A579"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:artica:pandora_fms:2.1.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "69446BEE-365D-49B5-9AEC-268AA93D8E2A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:artica:pandora_fms:3.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "CD917088-E151-4EC1-94AE-2D3F2F3A600B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:artica:pandora_fms:3.0:rc1:*:*:*:*:*:*" ,
"matchCriteriaId" : "8BBEA8F8-E1FB-4C62-91FD-67EBD5006F96"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:artica:pandora_fms:3.0:rc2:*:*:*:*:*:*" ,
"matchCriteriaId" : "98406056-AD7A-4A54-80B8-280E197F90ED"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:artica:pandora_fms:3.1:rc1:*:*:*:*:*:*" ,
"matchCriteriaId" : "B32CC8A6-A253-4DD2-867C-DCE583F073E0"
}
]
}
]
}
] ,
"references" : [
2024-04-04 08:46:00 +00:00
{
"url" : "http://osvdb.org/69549" ,
"source" : "cve@mitre.org"
} ,
2023-04-24 12:24:31 +02:00
{
"url" : "http://packetstormsecurity.com/files/129830/Pandora-3.1-Auth-Bypass-Arbitrary-File-Upload.html" ,
"source" : "cve@mitre.org"
} ,
{
"url" : "http://seclists.org/fulldisclosure/2010/Nov/326" ,
"source" : "cve@mitre.org"
} ,
2024-04-04 08:46:00 +00:00
{
"url" : "http://secunia.com/advisories/42347" ,
"source" : "cve@mitre.org"
} ,
2023-04-24 12:24:31 +02:00
{
"url" : "http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Patch"
]
} ,
{
"url" : "http://www.exploit-db.com/exploits/15639" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Exploit"
]
} ,
{
"url" : "http://www.securityfocus.com/archive/1/514939/100/0/threaded" ,
"source" : "cve@mitre.org"
} ,
{
"url" : "http://www.securityfocus.com/bid/45112" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Exploit" ,
"Patch"
]
} ,
{
"url" : "https://www.exploit-db.com/exploits/35731/" ,
"source" : "cve@mitre.org"
}
]
}
