CVE-2022-2032: Stored XSS in Pandora FMS ≤v761

Successful exploitation of CVE-2022-2032 allows an attacker, possessing administrator access to the Pandora FMS system, to inject arbitrary JavaScript code into the application. This code will then be executed in the context of other users' browsers when they access the affected file manager section. The impact ranges from session hijacking and defacement to potentially gaining access to sensitive data stored within the Pandora FMS system. While the CVSS score is LOW, the requirement for administrator privileges means the attack requires prior compromise or credential theft, increasing the complexity but not eliminating the risk.

1. Reserved2022-06-08
2. Published2022-07-25
3. Modified2024-09-16
4. EPSS updated2026-04-02

The primary mitigation for CVE-2022-2032 is to upgrade Pandora FMS to a version that includes the security patch. Consult the official Pandora FMS advisory for the specific patched version number. If immediate upgrading is not possible, consider implementing strict input validation and output encoding within the file manager section to sanitize user-supplied data. While a WAF might offer some protection, it's not a substitute for patching. Regularly review file manager access logs for suspicious activity.