CVE-2022-47372

What it actually does

Stored cross-site scripting allows persistent injection of malicious scripts into the Create event section that execute in the context of other authenticated console users.

Why it matters to the business

Attackers can hijack user sessions, steal credentials, or perform unauthorized actions inside the monitoring console, potentially disrupting operations or exfiltrating sensitive network data across many organizations using the affected software.

How an attack unfolds

An attacker with low-privileged console access crafts a malicious event containing script payloads; the payload is stored server-side and later rendered unsanitized for other users who view the event, executing attacker-controlled code in their browsers.

How to fix it

Upgrade Pandora FMS to a version newer than v766 that properly sanitizes event input; apply web application firewall rules that block common XSS patterns; enforce content security policy headers on all console pages.

How to confirm the fix worked

Review release notes for the upgrade that resolves stored XSS in event creation; test by attempting to create events containing script tags and confirm they are escaped or rejected; scan console responses for reflected or stored script execution.

Typical attack path

1. Obtain low-privileged access to the Pandora FMS console
2. Navigate to the Create event section and inject XSS payload into event fields
3. Save the event so the payload persists in the database
4. Social-engineer or wait for other users to view the affected event page
5. Execute actions such as credential theft or session hijacking via the running script

How to detect it

Search application and web server logs for event creation requests containing HTML or script tags; inspect stored event records in the database for unexpected script or iframe content; review user session activity following event views for unexpected redirects or form submissions.

• <script
• onerror=
• javascript:
• data:text/html

What your security team should do

• Prioritize upgrade of all Pandora FMS instances older than v766 within the next 30 days given the public disclosure age
• Implement input sanitization and output encoding for all event-related fields immediately
• Enable logging of event creation actions and monitor for anomalous script content
• Deploy CSP headers and WAF rules as defense-in-depth while upgrades are scheduled