Technical impact
Pandora FMS is vulnerable to session fixation, allowing attackers to hijack authenticated sessions by supplying a crafted session ID. This flaw falls under CWE-384 and enables an adversary to assume the identity of a legitimate user without needing the user’s credentials. The attacker may act with the same rights as the hijacked account, potentially accessing sensitive data, executing privileged operations, or causing further compromise within the affected environment.
Affected Systems
The vulnerability affects Pandora FMS versions ranging from 777 through 800. The vendor provides an official fix available in version 802 and 800.2, which addresses the session ID handling flaw.
Risk and Exploitability
The CVSS score is 7.6, indicating significant risk. The EPSS score is not available, so there is no current estimate of exploit probability, but the lack of KEV listing means the vulnerability is not yet known to be actively exploited in the wild. Based on the description, it is inferred that attackers can craft a valid session identifier remotely and supply it to the Pandora FMS web interface, thereby hijacking a legitimate user session. Successful exploitation would grant unauthorized access and privilege escalation without any local access, making the threat moderate to high for organizations using the affected versions.
