CVE-2022-26310CWE-285

Improper Authorization in User Management to Vertical Privilege Escalation

High · published August 1, 2022

CVSS v3.1
7.3
EPSS
1%
Percentile
52.9
In the wild
Unconfirmed
What it is

Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin user.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00709 · 52.9th percentile
Weakness
CWE-285 · Improper Authorization
Published
2022-08-01T12:45Z
EPSS history
Timeline
  • 01 AUG 12:45Z
    Improper Authorization in User Management to Vertical Privilege Escalation
    cvelistv5