CVE-2020-8500

Description

In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component. NOTE: The vendor reports that this is intended functionality

References

https://pandorafms.com/downloads/extension-uploader-feature-explained.mp4

https://k4m1ll0.com/cve-2020-8500.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS