CVE-2023-4677

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the application as an administrator. This issue affects Pandora FMS <= 772.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287CWE-532

Affected software

VendorProductVersions
Pandora FMSPandora FMS>= 700, <= 772

References

Timeline

Published
Nov 23, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-467707.5Out-of-bounds vulnerability in the sensor module. Successful exploitation of this vulnerability may cause mistouch prevention errors on userCVE-2023-467717.5Security vulnerability in the face unlock module. Successful exploitation of this vulnerability may affect service confidentiality.CVE-2023-467727.5Vulnerability of parameters being out of the value range in the QMI service module. Successful exploitation of this vulnerability may cause CVE-2023-467739.8Permission management vulnerability in the PMS module. Successful exploitation of this vulnerability may cause privilege escalation.CVE-2023-467747.5Vulnerability of uncaught exceptions in the NFC module. Successful exploitation of this vulnerability can affect NFC availability.CVE-2023-467758.8Cross-Site Request Forgery (CSRF) vulnerability in Djo Original texts Yandex WebMaster plugin <= 1.18 versions.CVE-2023-467768.8Cross-Site Request Forgery (CSRF) vulnerability in Serena Villa Auto Excerpt everywhere plugin <= 1.5 versions.CVE-2023-467778.8Cross-Site Request Forgery (CSRF) vulnerability in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha plugin <= 1.1.3 versiCVE-2023-467788.8Cross-Site Request Forgery (CSRF) vulnerability in TheFreeWindows Auto Limit Posts Reloaded plugin <= 2.5 versions.CVE-2023-467798.8Cross-Site Request Forgery (CSRF) vulnerability in EasyRecipe plugin <= 3.5.3251 versions.CVE-2023-46785.5Divide By Zero in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-467808.8Cross-Site Request Forgery (CSRF) vulnerability in Alter plugin <= 1.0 versions.