title: Server side request forgery in api checker
description: Server-Side Request Forgery (SSRF) vulnerability in API checker of Pandora FMS. Application does not have a check on the URL scheme used while retrieving API URL. Rather than validating the http/https scheme, the application allows other scheme such as file, which could allow a malicious user to fetch internal file content. This issue affects Pandora FMS v767 version and prior versions on all platforms.
problem types: CWE-918 Server-Side Request Forgery (SSRF)
affected:
{
defaultStatus: unaffected
platforms: All
product: Pandora FMS
vendor: Artica PFMS
versions:
lessThanOrEqual: v767, status: affected, version: v0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Fixed in v769