XSS Vulnerability Messages
CVE-2023-41814

3.7LOW

Key Information:

Vendor

Pandora FMS

Status
Pandora FMS
Vendor
CVE Published:
29 December 2023

What is CVE-2023-41814?

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Through an HTML payload (iframe tag) it is possible to carry out XSS attacks when the user receiving the messages opens their notifications. This issue affects Pandora FMS: from 700 through 774.

Affected Version(s)

Pandora FMS all 700 <= 774

References

https://pandorafms.com/en/security/common-vulnerabilities...
vendor-advisory

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabriel Weitzel <[email protected]>
.