CVE-2022-1648CWE-23

Relative Path Traversal to Remote Code Execution in File Manager

Medium · published July 26, 2022

CVSS v3.1
5.7
EPSS
1%
Percentile
71.8
In the wild
Unconfirmed
What it is

Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images directory which is restricted to execute the .php file. The impact could lead to a Remote Code Execution with running application privilege.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.01373 · 71.8th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2022-07-26T14:24Z
EPSS history
Timeline
  • 26 JUL 14:24Z
    Relative Path Traversal to Remote Code Execution in File Manager
    cvelistv5