Read the docs
TI-2020-06820 Aliases CVE-2020-8497GHSA-f6vw-wff5-r59f

In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history.

Priority LOW 32CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-306.

Summary

In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps.

Why it matters now

EPSS 0.04813 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:artica:pandora_fms:*:*:*:*:*:*:*:*up to 7.42VulnerableÁrtica
  • cpe:2.3:a:artica:pandora_fms:*:*:*:*:*:*:*:* Versions up to 7.42 Vulnerable ·Ártica

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8497
  2. 2026-10-03 Alias added: GHSA-f6vw-wff5-r59f

References

Exploit 1

  • TI-2010-04028 The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for… CVSS 2.0HIGH 10.0
  • TI-2024-12022 QuickShell Authenticated Command Injection CVSS 4.0HIGH 8.6
  • TI-2019-14584 netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote… CVSS 3.1HIGH 8.8
  • TI-2020-06822 In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a… CVSS 3.1HIGH 7.2
  • TI-2025-04766 Command Injection in Netflow path CVSS 4.0HIGH 7.0
  • TI-2021-12051 A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742… CVSS 3.1CRITICAL 9.8
See all 66 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences