CVE-2020-28907

CRITICAL

9.8

Description

Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an untrusted update package in upgrade_to_latest.sh.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie5/24/2021

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

nagios:fusion

Faiblesses (CWE)

CWE-295

References

http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html(cve@mitre.org)

https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/(cve@mitre.org)

https://www.nagios.com/downloads/nagios-xi/change-log/(cve@mitre.org)

http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/(af854a3a-2127-422b-91ae-364da2661108)

https://www.nagios.com/downloads/nagios-xi/change-log/(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.