SQL Injection Vulnerability in Nagios XI by Nagios
CVE-2023-40934

7.2HIGH

Key Information:

Vendor

Nagios

Status
Nagios Xi
Vendor
CVE Published:
19 September 2023

What is CVE-2023-40934?

A SQL injection vulnerability exists in Nagios XI, affecting versions 5.11.1 and earlier. This flaw enables authenticated attackers with sufficient privileges to manage host escalations within the Core Configuration Manager to execute arbitrary SQL commands. These commands can be embedded within the host escalation notification settings, potentially compromising the integrity of the database and exposing sensitive information.

References

http://nagios.com
https://www.nagios.com/products/security/
https://outpost24.com/blog/nagios-xi-vulnerabilities/

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.