CVE-2024-11320

Command Injection leading to RCE via LDAP Misconfiguration

Severity Score

6.9

*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

MITRE

Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS: from 700 through <=777.4

*Credits: Mohammad Askar <m.askar@isecur1ty.org>

CVSS Scores

Artica PFMSv4 6.9

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

High

User Interaction

Passive

System

Vulnerable | Subsequent

Confidentiality

Low

Integrity

High

Low

Availability

Low

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-11-18 CVE Reserved
2024-11-21 CVE Published
2024-11-21 CVE Updated
---------- EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

CAPEC

CAPEC-88: OS Command Injection
CAPEC-137: Parameter Injection

References (1)

URL	Tag	Source
https://pandorafms.com/en/security/common-vulnerabilities-and-exposures

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Pandora FMS Search vendor "Pandora FMS"		Pandora FMS Search vendor "Pandora FMS" for product "Pandora FMS"				>= 700.0 <= 777.4 Search vendor "Pandora FMS" for product "Pandora FMS" and version " >= 700.0 <= 777.4"		en		Affected