Improper Input Validation in Nagios XI Affected by Wildcard Handling
CVE-2021-36364

9.8CRITICAL

Key Information:

Vendor

Nagios

Status
Nagios Xi
Vendor
CVE Published:
28 September 2021

What is CVE-2021-36364?

The vulnerability in Nagios XI allows for improper handling of wildcards in the backup_xi.sh script. This oversight may enable an attacker to exploit the script with crafted input, potentially leading to unauthorized actions or access within the application. Organizations using versions prior to 5.8.5 are highly encouraged to upgrade to mitigate this risk. For detailed changes and recommendations, please refer to the official Nagios changelog.

References

https://www.nagios.com/downloads/nagios-xi/change-log/
x_refsource_CONFIRM
https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT
x_refsource_CONFIRM

EPSS Score

10% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.