CVE-2018-11223

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-06-16 · updated 2026-06-17
Weakness: CWE-79

Description

XSS in Artica Pandora FMS before 7.0 NG 723 allows an attacker to execute arbitrary code via a crafted "refr" parameter in a "/pandora_console/index.php?sec=estado&sec2=operation/agentes/estado_agente&refr=" call.

Affected products

Pandorafms Artica Pandora Fms: before 7.0_ng_723 — fixed in 7.0_ng_723

How to fix

Upgrade to a fixed version: Pandorafms Artica Pandora Fms 7.0_ng_723. Check the vendor advisory for mitigations.

References

https://blog.hackercat.ninja/post/pandoras_box/
https://pandorafms.com/wp-content/uploads/2018/06/whats-new-723-EN.pdf
https://blog.hackercat.ninja/post/pandoras_box/
https://pandorafms.com/wp-content/uploads/2018/06/whats-new-723-EN.pdf

Get alerted when CVE-2018-11223 or the next vulnerability affects your stack