CVE-2023-44091 is a high severity (CVSS 7.5) SQL injection in Pandora FMS from version 700 up to but not including 776. The vendor says it allowed SQL injection even when authentication failed. Pandora lists version 776 as the fix, so upgrade.
What's affected
The record covers Pandora FMS from 700 through versions below 776. The vendor's security page lists the issue as an unauthenticated time based SQL injection, fixed in version 776, and was published on 19 March 2024. The page does not repeat the affected range, so the range comes from the record.
The record scores 7.5 (High) with the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. That vector includes a low privilege requirement and high attack complexity, which sits oddly beside the description that authentication failure did not stop the attack. The vendor page calls it unauthenticated. We flag that mismatch and suggest you treat any exposed console as at risk. The weakness is CWE-89. The record does not mark the CVE as known exploited.
How to check if you're exposed
- Log in to the Pandora FMS console and look at the version in the footer or the About page.
- Anything from 700 up to below 776 is in scope. On the server, packages can be checked, for example with
rpm -qa | grep -i pandoraon RPM systems ordpkg -l | grep -i pandoraon Debian systems. - Find out whether the console is reachable from the internet or only from an internal network.
- Review web server logs for unusual long or repeated requests to the console, which can hint at time based probing.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.
What to do now
- Upgrade Pandora FMS to version 776 or later, following the vendor's upgrade guide.
- Restrict the web console to trusted networks or a VPN.
- Back up the database before upgrading.
- Review database accounts that Pandora uses and give them only the rights they need.
- Check logs for signs of abuse and rotate credentials stored in the monitoring system if you find any.
Why it matters
SQL injection happens when user input is combined with a database query unsafely. A time based variant lets an attacker learn data by watching how long the server takes to answer, even when no data is returned. That makes it work through endpoints that reveal nothing directly.
Monitoring platforms store credentials and network details for the systems they watch. A database flaw in one is attractive for that reason, and a monitoring console exposed to the internet is a bigger target than one behind a VPN.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Pandora FMS version fixes this?
Version 776, per the vendor's security page.
Does the attacker need to log in?
The vendor lists it as unauthenticated, while the CVSS vector lists a low privilege requirement. Treat it as reachable without a login.
Sources
Last reviewed: 19 October 2026.
