CVE-2022-43978

3.7 lowEPSS 0.3%

Low (3.7) in pandorafms pandora fms. EPSS 0.3% chance of exploitation in the next 30 days.

There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a login. Since the secret is static in generatePublicHash function, an attacker with knowledge of a valid session can abuse this in order to pass the authentication check.

Severity

CVSS 3.1

3.7 low

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWEs: CWE-798, CWE-287
Published: 2023-01-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

pandorafms:pandora_fms

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/

Check your stack JSON