Strix
26.1K

CVE-2010-4279

UnknownEPSS 65.62%

Last modified

CVE-2010-4279 is a vulnerability of currently unknown severity. The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhash_user parameter, in conjunction with the md5 hash of "admin" in the loginhash_data parameter.. EPSS estimates a 65.62% chance of exploitation in the next 30 days.

Description

The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhash_user parameter, in conjunction with the md5 hash of "admin" in the loginhash_data parameter.

Metrics

EPSS Probability
65.62%

99.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
ArticaPandora Fms<= 3.1—
ArticaPandora Fms1.2—
ArticaPandora Fms1.3—
ArticaPandora Fms1.3.1—
ArticaPandora Fms2.0—
ArticaPandora Fms2.1—
ArticaPandora Fms2.1.1—
ArticaPandora Fms3.0—
ArticaPandora Fms3.1Rc1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2010-4279?
The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhash_user parameter, in conjunction with the md5 hash of "admin" in the loginhash_data parameter.
How severe is CVE-2010-4279?
Severity scoring for CVE-2010-4279 is pending analysis. The EPSS model estimates a 65.62% probability of exploitation in the next 30 days.
How do I fix CVE-2010-4279?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2010-4279?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST