CVE-2019-13035 - CVE House
Back to Database
Status published High CVE-2019-13035

Artica Pandora FMS 7.0 NG before 735 suffers from local...

Vulnerability Description

Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\PandoraFMS and its sub-folders, allowing standard users to create new files. Moreover, the Apache service httpd.exe will try to execute cmd.exe from C:\PandoraFMS (the current directory) as NT AUTHORITY\SYSTEM upon web requests to the portal. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-13035

Credits & Attribution

No credits recorded in the NVD database.

References

More from pandorafms

View All →
CVE-2021-35501
PandoraFMS <=7.54 allows Stored XSS by placing a payload in...
Medium 5.4
CVE-2021-34074
PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote...
Critical 9.8
CVE-2020-13855
Artica Pandora FMS 7.44 allows arbitrary file upload (leading to...
High 7.2
CVE-2020-13854
Artica Pandora FMS 7.44 allows privilege escalation....
Critical 9.8
CVE-2020-13853
Artica Pandora FMS 7.44 has persistent XSS in the Messages...
Medium 5.4

Affected Vendor

Affected Software

pandora fms
Vulnerable Versions:
0

Timeline

Official Publish: June 29th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.