title: Vulnerability: Authenticated SQL Injection in API
description: Found a potential security vulnerability inside the Pandora API. Affected Pandora FMS version range: all versions of NG version, up to OUM 759. This vulnerability could allow an attacker with authenticated IP to inject SQL.
problem types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
affected:
{
product: Pandora FMS
vendor: Artica PFMS
versions:
lessThan: v759, status: affected, version: v759, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
version: 3.1
]
solutions: Fixed in version v760