CVE-2022-47373

What it actually does

Reflected XSS triggered when the username parameter in the forget-password flow of the Module Library lacks sanitization, allowing arbitrary JavaScript to execute in the context of any user who follows the crafted link.

Why it matters to the business

Attackers can steal session tokens or credentials from console administrators, leading to unauthorized access, data exposure, or further compromise of the monitoring platform.

How an attack unfolds

An attacker crafts a malicious URL containing a JavaScript payload in the username parameter of the forget-password endpoint, then tricks an authenticated console user into clicking the link; the browser reflects and executes the script, giving the attacker control within the Pandora FMS session.

How to fix it

Upgrade Pandora FMS Console to a version newer than 766 that properly sanitizes the username parameter; until then, restrict external access to the console and implement web-application firewall rules that block script tags and event handlers in query parameters.

How to confirm the fix worked

Reproduce the forget-password request with a test payload such as <script>alert(1)</script> in the username field and confirm the response no longer reflects executable script; review release notes for the applied input-validation changes.

Typical attack path

1. Identify the forget-password endpoint in the Module Library
2. Inject a script payload into the username parameter without proper encoding
3. Deliver the crafted link via phishing or another channel to a console user
4. Victim interaction causes the payload to execute in the browser
5. Attacker captures cookies, performs actions, or pivots inside the console

How to detect it

Inspect web-server access logs and application logs for forget-password or search requests that contain HTML tags, JavaScript keywords, or encoded script content in the username field; correlate with unusual session activity or unexpected admin actions.

• username=%3Cscript
• username=%3Cimg%20onerror
• forget_password.*username=.*alert
• ModuleLibrary.*search.*%3Cscript

What your security team should do

• Prioritize upgrade of all Pandora FMS instances beyond version 766
• Add WAF or proxy rules to neutralize script content in authentication-related parameters
• Enable detailed logging of password-reset requests and review for anomalous payloads
• Educate console administrators on recognizing suspicious password-reset links