CVE-2010-4282

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 19.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-12-02 · updated 2026-06-16
Weakness: CWE-22

Description

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php.

Affected products

Pandora FMS: through 3.1; 1.2, 1.3, 1.3-beta, 1.3-beta1, 1.3-beta2, 1.3-beta3 (+9)

References

http://osvdb.org/69543
http://osvdb.org/69544
http://osvdb.org/69545
http://seclists.org/fulldisclosure/2010/Nov/326
http://secunia.com/advisories/42347
http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download
http://www.exploit-db.com/exploits/15643
http://www.securityfocus.com/archive/1/514939/100/0/threaded
http://www.securityfocus.com/bid/45112
http://osvdb.org/69543
http://osvdb.org/69544
http://osvdb.org/69545

Get alerted when CVE-2010-4282 or the next vulnerability affects your stack