CVE-2022-45436

What it actually does

Stored cross-site scripting flaw allowing a manager-privileged user to persist an executable script payload inside a network map name field; the script runs in the context of an administrative user who later edits the map, enabling cookie theft or session hijacking.

Why it matters to the business

Attackers with limited access can obtain administrative credentials to the monitoring platform, potentially exposing sensitive network data, altering alerts, or pivoting into connected infrastructure.

How an attack unfolds

A manager-privileged account creates a network map whose name contains a crafted script payload. When an administrator opens the edit view for that map, the browser executes the payload, exfiltrating the admin session cookie or performing actions on the administrator's behalf.

How to fix it

Apply the vendor-supplied patch for Pandora FMS as soon as it becomes available. Until then, restrict manager accounts from creating or editing network maps, enforce strict input validation and output encoding on all name fields, and consider web-application firewall rules that block script tags in map-related POST parameters.

How to confirm the fix worked

After upgrade, attempt to create a network map whose name contains a benign script tag and confirm the tag is rendered as text rather than executed. Review release notes for explicit mention of the stored-XSS fix and re-test the edit-network-maps workflow with an administrative account.

Typical attack path

1. Authenticate as a manager-privileged user
2. Create a new network map and insert an XSS payload into the name field
3. Wait for or lure an administrator to access the edit-network-maps interface
4. Payload executes in the administrator browser and exfiltrates session data

How to detect it

Search web-server and application logs for POST or GET requests to network-map endpoints that contain angle-bracket characters or script/onerror keywords in the name parameter; correlate with subsequent admin sessions accessing those same map IDs.

• network_map_name=%3Cscript
• edit_network_maps.*name=.*%3C
• POST /pandorafms.*networkmap.*script

What your security team should do

• Subscribe to Pandora FMS security advisories and schedule immediate patching once a fixed build is released
• Temporarily disable or tightly scope the network-map creation permission for non-admin roles
• Deploy or tune WAF signatures to detect script, onerror, or javascript: patterns in map-name parameters
• Audit recent network-map objects for suspicious names containing angle brackets or event handlers