vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2019-13035

N/A
Published: June 29, 2019 at 12:51 PM UTC
Updated: June 17, 2026 at 02:15 AM UTC
1 product affected across 1 vendorPandora Fms

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 0.4%

Description

Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\PandoraFMS and its sub-folders, allowing standard users to create new files. Moreover, the Apache service httpd.exe will try to execute cmd.exe from C:\PandoraFMS (the current directory) as NT AUTHORITY\SYSTEM upon web requests to the portal. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Pandora Fms· Artica
95%
v < 7.0_ng_735
Affected range stops below 7.0_ng_735, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (1)

x_refsource_MISC
Source: [email protected]
https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-008.md

CVSS

7.2HIGH[email protected]
Confidentiality
COMPLETE
Integrity
COMPLETE
Availability
COMPLETE
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card