CVE-2019-19681

{"id": "CVE-2019-19681", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2019-12-26T16:15:10.857", "references": [{"url": "https://k4m1ll0.com/cve-2019-19681.html", "source": "cve@mitre.org"}, {"url": "https://medium.com/%40k4m1ll0/remote-code-execution-vulnerability-in-pandorafms-7-x-8ce55d4b1d5a", "source": "cve@mitre.org"}, {"url": "https://pandorafms.com/blog/pandora-fms-vulnerability/", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and execute commands as root/Administrator. NOTE: The product vendor states that the vulnerability as it is described is not in fact an actual vulnerability. They state that to be able to create alert commands, you need to have admin rights. They also state that the extended ACL system can disable access to specific sections of the configuration, such as defining new alert commands"}, {"lang": "es", "value": "** EN DISPUTA ** Pandora FMS 7.x sufre de vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo. Con un usuario autenticado que puede modificar el sistema de alerta, es posible definir y ejecutar comandos como root / Administrador. NOTA: El proveedor del producto afirma que la vulnerabilidad tal como se describe no es en realidad una vulnerabilidad real. Afirman que para poder crear comandos de alerta, debe tener derechos de administrador. Tambi\u00e9n afirman que el sistema ACL extendido puede inhabilitar el acceso a secciones espec\u00edficas de la configuraci\u00f3n, como definir nuevos comandos de alerta."}], "lastModified": "2024-04-11T01:05:02.530", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:artica:pandora_fms:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60CEE4B3-B2D2-4823-B626-214B2ED406DE"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}