CVE-2019-20197

HIGH

8.8

Description

In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account.

CVE Details

CVSS v3.1 Score8.8

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published12/31/2019

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

nagios:nagios_xi

Weaknesses (CWE)

CWE-78

References

https://code610.blogspot.com/2019/12/postauth-rce-in-latest-nagiosxi.html(cve@mitre.org)

https://code610.blogspot.com/2019/12/postauth-rce-in-latest-nagiosxi.html(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.