CVE-2019-13035 - Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\PandoraFMS and its sub-folders, allowing standard users to create new files

Back Back to CVE browser

HIGH

Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\PandoraFMS and its sub-folders, allowing standard users to create new files

Published Jun 29, 2019

7.8

HIGH

CVSS 3.0

EPSS 0.39%

Description

Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\PandoraFMS and its sub-folders, allowing standard users to create new files. Moreover, the Apache service httpd.exe will try to execute cmd.exe from C:\PandoraFMS (the current directory) as NT AUTHORITY\SYSTEM upon web requests to the portal. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (1)

https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-008.md
x_refsource_MISC

Link	Providers	Tags
https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-008.md		x_refsource_MISC

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jun 29, 2019

Updated Aug 4, 2024

Reserved Jun 29, 2019

Link CVE-2019-13035

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-13035

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-13035