Nagios: Security Vulnerabilities
Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been mistakenly associated with CVE-2020-1408.
CVSS Score
4.9
EPSS Score
0.019
Published
2020-06-09
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.
CVSS Score
4.8
EPSS Score
0.242
Published
2020-03-22
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.
CVSS Score
4.8
EPSS Score
0.045
Published
2020-03-22
Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.
CVSS Score
4.8
EPSS Score
0.242
Published
2020-03-22
Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline sequence). This can cause command injection.
CVSS Score
7.3
EPSS Score
0.003
Published
2020-03-16
Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.
CVSS Score
7.5
EPSS Score
0.016
Published
2020-03-16
Nagios Log Server 2.1.3 has Incorrect Access Control.
CVSS Score
6.5
EPSS Score
0.005
Published
2020-03-16
Nagios Log Server 2.1.3 has CSRF.
CVSS Score
8.8
EPSS Score
0.009
Published
2020-03-16
Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered.
CVSS Score
5.4
EPSS Score
0.073
Published
2020-03-16
UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to cause cause DoS or potentially escalate privileges by winning a race. This issue affects: SUSE Linux Enterprise Server 12 nagios version 3.5.1-5.27 and prior versions. SUSE Linux Enterprise Server 11 nagios version 3.0.6-1.25.36.3.1 and prior versions. openSUSE Factory nagios version 4.4.5-2.1 and prior versions.
CVSS Score
5.7
EPSS Score
0.001
Published
2020-02-28