EUVD-2026-29495
GHSA-x5vj-9j33-4gff
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:L/U:Amber
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:L/U:Amber
Lifecycle Timeline
3DescriptionCVE.org
Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 through 800
AnalysisAI
Cross-Site Request Forgery in Pandora FMS versions 777 through 800 enables attackers to execute unauthorized administrative actions through victim interaction with malicious web pages. The network-accessible attack requires no authentication but depends on user interaction (CVSS AV:N/PR:N/UI:P), allowing high integrity impact (VI:H) with limited confidentiality exposure (VC:L). No active exploitation confirmed (CISA KEV not listed), EPSS data not available for assessment. Vendor Pandora FMS has acknowledged the vulnerability with public disclosure.
Technical ContextAI
This vulnerability stems from insufficient CSRF protections (CWE-352) in Pandora FMS, an open-source network monitoring platform. CSRF attacks exploit the trust a web application has in authenticated user browsers by forcing victims to submit state-changing requests without their knowledge. The affected cpe:2.3:a:pandora_fms:pandora_fms applies to versions 777-800, indicating a sustained weakness across multiple releases. Pandora FMS uses PHP-based session management for administrative interfaces; without proper anti-CSRF tokens or SameSite cookie attributes, authenticated admin sessions become vulnerable to forged requests originating from attacker-controlled domains. The CVSS 4.0 vector indicates network attack delivery (AV:N) with low complexity (AC:L), meaning exploitation requires only standard web techniques like HTML forms or JavaScript within attacker-hosted pages.
RemediationAI
Upgrade to Pandora FMS version 801 or later if available, as versions 777-800 are confirmed vulnerable and the version numbering suggests subsequent releases address this issue; verify patch status directly with the vendor advisory at https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/. If immediate patching is not feasible, implement compensating controls: configure web application firewalls to validate Referer and Origin headers for administrative endpoints, rejecting requests from external domains (trade-off: may break legitimate cross-origin integrations); enable HTTP Strict-Transport-Security and deploy SameSite=Strict cookie attributes for session cookies to prevent cross-site transmission (trade-off: breaks functionality if administrators access Pandora FMS from bookmarks on different domains); restrict administrative interface access to dedicated management VLANs or VPN-only access, reducing exposure to CSRF payloads delivered via internet-sourced pages (trade-off: operational overhead for remote administration). Monitor authentication logs for unusual administrative actions coinciding with external network activity.
More in Pandora Fms
View allPandora FMS monitoring platform versions 700 through 777.6 contain a command injection vulnerability that allows OS comm
Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue af
An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php
Artica Pandora FMS 7.44 allows remote command execution via the events feature. Rated high severity (CVSS 8.8), this vul
Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication me
PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager. Rated criti
A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attac
Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization. Rated critical severity (CVSS 9
Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandora_console/
Artica Pandora FMS 7.44 allows privilege escalation. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. Rated critical severity
Artica Pandora FMS 7.44 has inadequate access controls on a web folder. Rated high severity (CVSS 7.5), this vulnerabili
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today