CVE-2022-43978: Pandorafms Pandora Fms

Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days.

There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a login. Since the secret is static in generatePublicHash function, an attacker with knowledge of a valid session can abuse this in order to pass the authentication check.

Affected products

• Pandorafms Pandora Fms: before 766 (fixed in 766)

Published 2023-01-27. Last modified 2026-06-17.