CVE Daily

CVE-2010-4279

The default configuration of Pandora FMS 3.1 and earlier specifies an empty stri...

Critical CVSS 10.0

Overview

The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhash_user parameter, in conjunction with the md5 hash of "admin" in the loginhash_data parameter.

CWE: CWE-287 Published: 2010-12-02T17:15:00.503
Risk analysis

This vulnerability is rated 🔴 CRITICAL.

  • CVSS: 10.0 (CRITICAL)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags