CVE-2020-8947: OS Command Injection

Published Feb 12, 2020

Updated

functionsnetflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nfliveview ipdst, dstport, or srcport parameter, a different vulnerability than CVE-2019-20224.

Affected Software

1 affected component

Artica Pandora FMS=7.0

Event History

Feb 12, 2020

CVE Published

via MITRE·05:52 PM

Data Sourced

via MITRE·05:52 PM

Description

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2020-8947?

CVE-2020-8947 is a vulnerability in Artica Pandora FMS 7.0 that allows remote attackers to execute arbitrary OS commands.

How does CVE-2020-8947 work?

CVE-2020-8947 works by exploiting shell metacharacters in the index.php?operation/netflow/nf_live_view ip_dst, dst_port, or src_port parameter.

What is the severity of CVE-2020-8947?

The severity of CVE-2020-8947 is critical with a score of 7.2.

Which version of Artica Pandora FMS is affected by CVE-2020-8947?

Artica Pandora FMS 7.0 is affected by CVE-2020-8947.

How can I fix CVE-2020-8947?

To fix CVE-2020-8947, it is recommended to update Artica Pandora FMS to a version that does not have this vulnerability.