What’s Vulnerable › Vulnerabilities

CVE-2022-43980: Cross-site scripting vulnerability in the network maps edit functionality

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-01-27 · updated 2026-06-17
• Weakness: CWE-352

Description

There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin privileges clicks on the edited network maps, the XSS payload will be executed. The exploitation of this vulnerability could allow an atacker to steal the value of the admin user´s cookie.

Affected products

• Artica PFMS Pandora FMS: before 766 — fixed in 766

How to fix

Upgrade to a fixed version: Artica PFMS Pandora FMS 766. Check the vendor advisory for mitigations.

References

• https://github.com/Argonx21/CVE-2022-43980
• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
• https://github.com/Argonx21/CVE-2022-43980
• https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/

Get alerted when CVE-2022-43980 or the next vulnerability affects your stack