The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhash_user parameter, in conjunction with the md5 hash of "admin" in the loginhash_data parameter.
| Software | From | Fixed in |
|---|---|---|
| artica / pandora_fms | - | 3.1.x |
| artica / pandora_fms | 1.2 | 1.2.x |
| artica / pandora_fms | 1.3 | 1.3.x |
| artica / pandora_fms | 1.3-beta | 1.3-beta.x |
| artica / pandora_fms | 1.3-beta1 | 1.3-beta1.x |
| artica / pandora_fms | 1.3-beta2 | 1.3-beta2.x |
| artica / pandora_fms | 1.3-beta3 | 1.3-beta3.x |
| artica / pandora_fms | 1.3.1 | 1.3.1.x |
| artica / pandora_fms | 2.0 | 2.0.x |
| artica / pandora_fms | 2.0-beta | 2.0-beta.x |
| artica / pandora_fms | 2.1 | 2.1.x |
| artica / pandora_fms | 2.1.1 | 2.1.1.x |
| artica / pandora_fms | 3.0 | 3.0.x |
| artica / pandora_fms | 3.0-rc1 | 3.0-rc1.x |
| artica / pandora_fms | 3.0-rc2 | 3.0-rc2.x |
| artica / pandora_fms | 3.1-rc1 | 3.1-rc1.x |