Pandora Fms CVE-2020-13854

CRITICAL

Improper Privilege Management (CWE-269)

2020-06-11 cve@mitre.org

Privilege Escalation Pandora Fms

9.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Jun 11, 2020 - 03:15 nvd

CRITICAL 9.8

DescriptionNVD

Artica Pandora FMS 7.44 allows privilege escalation.

AnalysisAI

Artica Pandora FMS 7.44 allows privilege escalation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. Affected products include: Pandorafms Pandora Fms.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.

More in Pandora Fms

View all

CVE-2024-12971 HIGH Act Now POC

Pandora FMS monitoring platform versions 700 through 777.6 contain a command injection vulnerability that allows OS comm

CVE-2025-5306 CRITICAL Emergency POC

Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue af

CVE-2025-34088 HIGH Act Now POC

An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php

CVE-2020-13851 HIGH Act Now POC

Artica Pandora FMS 7.44 allows remote command execution via the events feature. Rated high severity (CVSS 8.8), this vul

CVE-2024-11320 MEDIUM This Month POC

Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication me

CVE-2021-34074 CRITICAL Act Now POC

PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager. Rated criti

CVE-2021-32099 CRITICAL Act Now POC

A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attac

CVE-2021-32098 CRITICAL Act Now POC

Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization. Rated critical severity (CVSS 9

CVE-2020-26518 CRITICAL Act Now POC

Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandora_console/

CVE-2020-11749 CRITICAL Act Now POC

Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. Rated critical severity

CVE-2020-13850 HIGH This Week POC

Artica Pandora FMS 7.44 has inadequate access controls on a web folder. Rated high severity (CVSS 7.5), this vulnerabili

CVE-2018-11222 HIGH This Week POC

Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /p

Same weakness CWE-269 – Improper Privilege Management

View all

CVE-2017-5689 CRITICAL POC

CVE-2017-12635 CRITICAL POC

CVE-2012-3993 CRITICAL POC

CVE-2017-11467 CRITICAL POC

CVE-2014-1510 CRITICAL POC

CVE-2014-1511 CRITICAL POC

CVE-2016-0151 HIGH POC

CVE-2013-0643 HIGH

Same technique Privilege Escalation

View all

CVE-2025-47812 CRITICAL POC

CVE-2013-0422 CRITICAL POC

CVE-2013-0632 CRITICAL POC

CVE-2017-5689 CRITICAL POC

CVE-2017-12635 CRITICAL POC

CVE-2016-10372 CRITICAL POC

CVE-2014-9583 CRITICAL POC

CVE-2012-0297 CRITICAL POC

Share

CVE-2020-13854 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy