CVE-2022-2059: Stored XSS in Pandora FMS 7.61

The primary impact of CVE-2022-2059 is the potential for an attacker to execute arbitrary JavaScript code within the Pandora FMS web interface. This can be achieved by crafting a malicious script and injecting it through the agent alias field during agent creation. Successful exploitation could allow an attacker to steal session cookies, impersonate legitimate administrators, modify system configurations, or deface the web interface. The requirement for administrator privileges limits the immediate blast radius, but a compromised administrator account could grant access to sensitive data and systems managed by Pandora FMS. While no public exploits are currently known, the ease of exploitation makes this a concerning vulnerability, particularly for organizations relying on Pandora FMS for critical monitoring and alerting.

1. Reserved2022-06-13
2. Published2022-07-25
3. Modified2024-09-16
4. EPSS updated2026-04-02

The primary mitigation for CVE-2022-2059 is to upgrade to a patched version of Pandora FMS. Refer to the vendor's advisory for the specific version containing the fix. If upgrading immediately is not feasible, consider implementing strict input validation on the agent alias field to sanitize any potentially malicious characters. While not a complete solution, this can reduce the attack surface. Additionally, review and restrict administrator privileges to the minimum necessary for each user. Monitor web application firewalls (WAFs) for suspicious activity related to script injection attempts. After upgrading, confirm the vulnerability is resolved by attempting to create an agent with a specially crafted alias containing a simple JavaScript payload (e.g., <script>alert('XSS')</script>).