VULNERABILITY INTELLIGENCE

CVE-2010-4279

CVSS score10 HIGH
EPSS probability65.62%
CISA KEVNot currently listed
Published2010-12-02
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:C/I:C/A:C

Description

The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhash_user parameter, in conjunction with the md5 hash of "admin" in the loginhash_data parameter.

Weakness classification

  • CWE-287: Improper Authentication

Primary references