CVE-2010-4282 (GCVE-0-2010-4282)

Vulnerability from cvelistv5 – Published: 2010-12-02 17:00 – Updated: 2024-08-07 03:43
VLAI
Summary
Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://osvdb.org/69545 vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/42347 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/archive/1/514939/100… mailing-listx_refsource_BUGTRAQ
http://sourceforge.net/projects/pandora/files/Pan… x_refsource_CONFIRM
http://osvdb.org/69543 vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/bid/45112 vdb-entryx_refsource_BID
http://osvdb.org/69544 vdb-entryx_refsource_OSVDB
http://seclists.org/fulldisclosure/2010/Nov/326 mailing-listx_refsource_FULLDISC
http://www.exploit-db.com/exploits/15643 exploitx_refsource_EXPLOIT-DB
Date Public
2010-10-13 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T03:43:14.042Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "69545",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/69545"
          },
          {
            "name": "42347",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/42347"
          },
          {
            "name": "20101130 Pandora FMS Authentication Bypass and Multiple Input Validation Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/514939/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download"
          },
          {
            "name": "69543",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/69543"
          },
          {
            "name": "45112",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/45112"
          },
          {
            "name": "69544",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/69544"
          },
          {
            "name": "20101130 Pandora FMS Authentication Bypass and Multiple\tInput Validation Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2010/Nov/326"
          },
          {
            "name": "15643",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/15643"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-10-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "69545",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/69545"
        },
        {
          "name": "42347",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/42347"
        },
        {
          "name": "20101130 Pandora FMS Authentication Bypass and Multiple Input Validation Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/514939/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download"
        },
        {
          "name": "69543",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/69543"
        },
        {
          "name": "45112",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/45112"
        },
        {
          "name": "69544",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/69544"
        },
        {
          "name": "20101130 Pandora FMS Authentication Bypass and Multiple\tInput Validation Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2010/Nov/326"
        },
        {
          "name": "15643",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/15643"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-4282",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "69545",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/69545"
            },
            {
              "name": "42347",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/42347"
            },
            {
              "name": "20101130 Pandora FMS Authentication Bypass and Multiple Input Validation Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/514939/100/0/threaded"
            },
            {
              "name": "http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download",
              "refsource": "CONFIRM",
              "url": "http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download"
            },
            {
              "name": "69543",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/69543"
            },
            {
              "name": "45112",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/45112"
            },
            {
              "name": "69544",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/69544"
            },
            {
              "name": "20101130 Pandora FMS Authentication Bypass and Multiple\tInput Validation Vulnerabilities",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2010/Nov/326"
            },
            {
              "name": "15643",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/15643"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2010-4282",
    "datePublished": "2010-12-02T17:00:00.000Z",
    "dateReserved": "2010-11-17T00:00:00.000Z",
    "dateUpdated": "2024-08-07T03:43:14.042Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2010-4282",
      "date": "2026-07-31",
      "epss": "0.19495",
      "percentile": "0.97098"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2010-4282\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2010-12-02T17:15:00.597\",\"lastModified\":\"2026-04-29T01:13:23.040\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php.\"},{\"lang\":\"es\",\"value\":\"M\u00faltiples vulnerabilidades de salto de directorio en FMS anterior a v3.1.1 permite a atacantes remotos incluir y ejecutar ficheros locales de su elecci\u00f3n mediante (1) el par\u00e1metro page para ajax.php o (2) el par\u00e1metro id para general/pandora_help.php, y permite a atacantes remotos incluir, ejecutar, crear, modificar, o borrar ficheros locales de su elecci\u00f3n mediante (3) el par\u00e1metro layout para operation/agentes/networkmap.php.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:artica:pandora_fms:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.1\",\"matchCriteriaId\":\"A972A8C1-4418-457A-B333-31CBFEA87F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:artica:pandora_fms:1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5F58083-665E-40CE-94E8-AF46BD41E2B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:artica:pandora_fms:1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C4153C42-C38B-4DF8-9C24-2060FB18F370\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:artica:pandora_fms:1.3:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"2544AF2E-0BA3-409F-9AF4-7B42751C8E56\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:artica:pandora_fms:1.3:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"95734EBF-826B-43B9-B790-111329AB8581\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:artica:pandora_fms:1.3:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"34FB9160-6109-4C68-B8C2-E9FF5FA1E783\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:artica:pandora_fms:1.3:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7220D9B-1FAB-4265-90D9-87630AE906B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:artica:pandora_fms:1.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F912B082-3834-462C-956E-5003E5CDF624\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:artica:pandora_fms:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE24C15F-4653-46CB-9C8F-6DE942154B65\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:artica:pandora_fms:2.0:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"1464A86D-222B-49BD-A4F5-9AE5AD57E016\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:artica:pandora_fms:2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAF92EC0-0616-4F17-9588-70C22C69A579\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:artica:pandora_fms:2.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"69446BEE-365D-49B5-9AEC-268AA93D8E2A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:artica:pandora_fms:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD917088-E151-4EC1-94AE-2D3F2F3A600B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:artica:pandora_fms:3.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8BBEA8F8-E1FB-4C62-91FD-67EBD5006F96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:artica:pandora_fms:3.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"98406056-AD7A-4A54-80B8-280E197F90ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:artica:pandora_fms:3.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B32CC8A6-A253-4DD2-867C-DCE583F073E0\"}]}]}],\"references\":[{\"url\":\"http://osvdb.org/69543\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/69544\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/69545\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://seclists.org/fulldisclosure/2010/Nov/326\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/42347\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.exploit-db.com/exploits/15643\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\"]},{\"url\":\"http://www.securityfocus.com/archive/1/514939/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/45112\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"http://osvdb.org/69543\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://osvdb.org/69544\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://osvdb.org/69545\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://seclists.org/fulldisclosure/2010/Nov/326\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/42347\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.exploit-db.com/exploits/15643\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]},{\"url\":\"http://www.securityfocus.com/archive/1/514939/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/45112\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}"
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.