CVE-2022-43978: There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a…

PriorityP415low3.7CVSS 3.1

AVNACHPRLUIRSUCLILAN

EPSS

0.30%

22.0th percentile

There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a login. Since the secret is static in generatePublicHash function, an attacker with knowledge of a valid session can abuse this in order to pass the authentication check.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
artica_pfms	pandora_fms	v764 – v764	—
pandorafms	pandora_fms	< 766	766

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.