title: Uploading executables via the file manager
description: Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allowed PHP executable files to be uploaded through the file manager. This issue affects Pandora FMS: from 700 through 773.
problem types: CWE-434 Unrestricted Upload of File with Dangerous Type
affected:
{
defaultStatus: unaffected
platforms: all
product: Pandora FMS
vendor: Pandora FMS
versions:
lessThanOrEqual: 773, status: affected, version: 700, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Fixed in v774 and v772.2.