CVE-2023-41789CWE-79

Unauthenticated Admin Account Takeover Via XSS

High · published November 23, 2023

CVSS v3.1
7.6
EPSS
0%
Percentile
38.6
In the wild
Unconfirmed
What it is

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allows an attacker to perform cookie hijacking and log in as that user without the need for credentials. This issue affects Pandora FMS: from 700 through 773.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00457 · 38.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-11-23T14:36Z
EPSS history
Timeline
  • 23 NOV 14:36Z
    Unauthenticated Admin Account Takeover Via XSS
    cvelistv5