The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with admin in the loginhash_user parameter, in conjunction with the md5 hash of admin in the loginhash_data parameter.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pandora_fms | Artica | * | 3.1 (including) |
| Pandora_fms | Artica | 1.2 (including) | 1.2 (including) |
| Pandora_fms | Artica | 1.3 (including) | 1.3 (including) |
| Pandora_fms | Artica | 1.3-beta (including) | 1.3-beta (including) |
| Pandora_fms | Artica | 1.3-beta1 (including) | 1.3-beta1 (including) |
| Pandora_fms | Artica | 1.3-beta2 (including) | 1.3-beta2 (including) |
| Pandora_fms | Artica | 1.3-beta3 (including) | 1.3-beta3 (including) |
| Pandora_fms | Artica | 1.3.1 (including) | 1.3.1 (including) |
| Pandora_fms | Artica | 2.0 (including) | 2.0 (including) |
| Pandora_fms | Artica | 2.0-beta (including) | 2.0-beta (including) |
| Pandora_fms | Artica | 2.1 (including) | 2.1 (including) |
| Pandora_fms | Artica | 2.1.1 (including) | 2.1.1 (including) |
| Pandora_fms | Artica | 3.0 (including) | 3.0 (including) |
| Pandora_fms | Artica | 3.0-rc1 (including) | 3.0-rc1 (including) |
| Pandora_fms | Artica | 3.0-rc2 (including) | 3.0-rc2 (including) |
| Pandora_fms | Artica | 3.1-rc1 (including) | 3.1-rc1 (including) |