GCVE - cpe:2.3:a:percona:monitoring_and_management:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:percona:monitoring_and_management:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Percona (`a943a4ac-2523-5adb-84df-f6d27f94d392`)
Product	Monitoring And Management (`3bb96ca4-1661-5e2a-bdb9-280253dc6bf8`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/percona/pmm-managed`	purl2cpe	2026-06-01 10:17:28.242736

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-25212`	vulnerable	2026-06-08 07:53:19.511246	Details available An issue was discovered in Percona PMM before 3.7. Because an internal database user retains specific superuser privileges, an attacker with pmm-admin rights can abuse the "Add data source" feature to break out of the database context and execute shell commands on the underlying operating system. Published: 2026-04-02T00:00:00.000Z Updated: 2026-04-02T17:39:21.169Z Open on db.gcve.eu Reference links https://percona.com https://docs.percona.com/percona-monitoring-and-management/3/release-notes/3.7.0.html#authenticated-remote-code-execution-via-internal-data-source-cve-2026-25212	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-26701`	vulnerable	2026-06-08 07:14:50.353951	Details available CRITICAL (10) An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, and sensitive data exposure. This is fixed in PMM2 2.42.0-1.ova, 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.ova, and 2.44.0-1.ova and in PMM3 3.0.0-1.ova and later. Published: 2025-03-11T00:00:00.000Z Updated: 2025-03-11T19:27:40.631Z Open on db.gcve.eu Reference links https://www.percona.com/blog/security-advisory-cve-affecting-percona-monitoring-and-management-pmm/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-34409`	vulnerable	2026-06-08 06:06:25.441216	Details available In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth_server.go does not properly formalize and sanitize URL paths to reject path traversal attempts. This allows an unauthenticated remote user, when a crafted POST request is made against unauthenticated API routes, to access otherwise protected API routes leading to escalation of privileges and information disclosure. Published: 2023-06-06T00:00:00.000Z Updated: 2025-01-08T16:01:28.778Z Open on db.gcve.eu Reference links https://www.percona.com/blog/pmm-authentication-bypass-vulnerability-fixed-in-2-37-1/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-7920`	vulnerable	2026-06-08 05:27:14.492298	Details available pmm-server in Percona Monitoring and Management (PMM) 2.2.x before 2.2.1 allows unauthenticated denial of service. Published: 2020-02-06T16:51:52.000Z Updated: 2024-08-04T09:48:23.900Z Open on db.gcve.eu Reference links https://www.percona.com/doc/percona-monitoring-and-management/2.x/release-notes/2.2.1.html https://jira.percona.com/browse/PMM-5233 https://jira.percona.com/browse/PMM-5232 https://www.percona.com/blog/2020/02/03/improvements-in-pmm-bug-fixes-in-percona-server-percona-backup-for-mongodb-alert-release-roundup-2-3-2020/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.