CVE-2022-26310
Last modified
CVE-2022-26310 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin user.. EPSS estimates a 0.58% chance of exploitation in the next 30 days.
Description
Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin user.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pandorafms | Pandora Fms | <= 7.0_ng_760 |
References
- https://www.incibe.es/en/cve-assignment-publication/coordinated-cvesThird Party Advisory
- https://www.incibe.es/en/cve-assignment-publication/coordinated-cvesThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-26310?
How severe is CVE-2022-26310?
How do I fix CVE-2022-26310?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-26305An Improper Certificate Validation vulnerability in LibreOff…7.5
- CVE-2022-26306LibreOffice supports the storage of passwords for web connec…7.5
- CVE-2022-26307LibreOffice supports the storage of passwords for web connec…8.8
- CVE-2022-26308Pandora FMS v7.0NG.760 and below allows an improper access c…5.4
- CVE-2022-26309Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in …8.8
- CVE-2022-2631Improper Access Control in GitHub repository tooljet/tooljet…8.8
- CVE-2022-26311Couchbase Operator 2.2.x before 2.2.3 exposes Sensitive Info…7.5
- CVE-2022-26313A vulnerability has been identified in Mendix Forgot Passwor…9.8
- CVE-2022-26314A vulnerability has been identified in Mendix Forgot Passwor…9.8
- CVE-2022-26315qrcp through 0.8.4, in receive mode, allows ../ Directory Tr…5.3
- CVE-2022-26317A vulnerability has been identified in Mendix Applications u…6.5
- CVE-2022-26318On WatchGuard Firebox and XTM appliances, an unauthenticated…9.8
Are you affected by CVE-2022-26310?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST