CVE-2022-45437

What it actually does

Stored cross-site scripting flaw allowing a user with report editing rights to inject executable script into the dashboard module that executes in an administrator browser context without further interaction.

Why it matters to the business

Attackers can obtain sensitive session tokens or administrative data displayed to high-privilege users, increasing risk of account takeover and unauthorized access to monitoring data across the environment.

How an attack unfolds

An authenticated editor crafts a malicious payload inside a reporting dashboard module; when an administrator later views the same dashboard the script executes in their session, exfiltrating cookies or other information to the attacker.

How to fix it

Upgrade to the latest patched release of Pandora FMS as soon as it becomes available; until then restrict report editing rights to trusted users only and implement web application firewall rules that block common script patterns in dashboard content.

How to confirm the fix worked

Review release notes for the fix version, re-test the reporting dashboard module with previously injectable payloads, and confirm that reflected or stored script no longer executes when viewed by administrators.

Typical attack path

1. Obtain an account with report editing privileges
2. Create or edit a reporting dashboard module and insert a crafted script payload
3. Wait for an administrator to view the affected dashboard
4. Script executes in the administrator browser and exfiltrates data or performs actions on behalf of the admin

How to detect it

Search web server and application logs for dashboard module submissions or renders that contain HTML script, onerror, or onload attributes; inspect stored report definitions for unexpected markup; correlate with administrator session activity immediately after dashboard views.

What your security team should do

• Immediately audit which accounts hold report editing privileges and reduce that group to the minimum necessary
• Monitor vendor announcements for the availability of a patched release and schedule upgrade
• Deploy compensating controls such as content security policy headers on the web interface
• Add SIEM alerts for any new or modified dashboard modules containing script tags or event handlers