daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/http/cves/2020/CVE-2020-8497.yaml

46 lines
1.3 KiB
YAML
Raw Normal View History

Create CVE-2020-8497.yaml In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-12-05 23:36:14 +00:00
id: CVE-2020-8497
info:
Enhancement: cves/2020/CVE-2020-8497.yaml by md
2023-04-04 20:20:19 +00:00
name: Artica Pandora FMS <=7.42 - Arbitrary File Read
Create CVE-2020-8497.yaml In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-12-05 23:36:14 +00:00
author: gy741
severity: medium
Syntax errors
2023-04-10 19:56:05 +00:00
description: Artica Pandora FMS through 7.42 is susceptible to arbitrary file read. An attacker can read the chat history, which is in JSON format and contains user names, user IDs, private messages, and timestamps. This can potentially lead to unauthorized data modification and other operations.
updated 2020 CVEs
2023-09-06 12:22:36 +00:00
remediation: |
Upgrade Artica Pandora FMS to version 7.43 or later to mitigate this vulnerability.
Update CVE-2020-8497.yaml
2021-12-06 05:09:43 +00:00
reference:
- https://k4m1ll0.com/cve-2020-8497.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-8497
Create CVE-2020-8497.yaml In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-12-05 23:36:14 +00:00
classification:
additional reference to cves templates (#4395) * additional reference to cves templates * Update CVE-2006-1681.yaml * Update CVE-2009-3318.yaml * Update CVE-2009-4223.yaml * Update CVE-2010-0942.yaml * Update CVE-2010-0944.yaml * Update CVE-2010-0972.yaml * Update CVE-2010-1304.yaml * Update CVE-2010-1308.yaml * Update CVE-2010-1313.yaml * Update CVE-2010-1461.yaml * Update CVE-2010-1470.yaml * Update CVE-2010-1471.yaml * Update CVE-2010-1472.yaml * Update CVE-2010-1474.yaml * removed duplicate references * misc fix Co-authored-by: Prince Chaddha <prince@projectdiscovery.io> Co-authored-by: Prince Chaddha <cyberbossprince@gmail.com>
2022-05-17 09:18:12 +00:00
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
cvss-score: 5.3
Create CVE-2020-8497.yaml In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-12-05 23:36:14 +00:00
cve-id: CVE-2020-8497
cwe-id: CWE-306
Added CPE and EPSS Score to CVE Templates
2023-04-12 10:55:48 +00:00
epss-score: 0.002
Added EPSS Percentile
2023-08-31 11:46:18 +00:00
epss-percentile: 0.57104
updated 2020 CVEs
2023-09-06 12:22:36 +00:00
cpe: cpe:2.3:a:artica:pandora_fms:*:*:*:*:*:*:*:*
Added max request counter of each template
2023-04-28 08:11:21 +00:00
metadata:
max-request: 1
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
vendor: artica
product: pandora_fms
tags: cve,cve2020,fms,artica
Create CVE-2020-8497.yaml In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-12-05 23:36:14 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
2023-04-27 04:28:59 +00:00
http:
Create CVE-2020-8497.yaml In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-12-05 23:36:14 +00:00
- method: GET
path:
- '{{BaseURL}}/pandora_console/attachment/pandora_chat.log.json.txt'
matchers-condition: and
matchers:
- type: word
part: body
Update CVE-2020-8497.yaml
2021-12-06 05:09:43 +00:00
words:
- '"type"'
- '"id_user"'
- '"user_name"'
- '"text"'
Create CVE-2020-8497.yaml In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-12-05 23:36:14 +00:00
condition: and
- type: status
status:
- 200