Vulnerability-Lookup - Search a vulnerability

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Nagios XI versions ant\u00e9rieures \u00e0 2026R1.0.1",
      "product": {
        "name": "Nagios XI",
        "vendor": {
          "name": "Nagios",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "initial_release_date": "2025-11-12T00:00:00",
  "last_revision_date": "2025-11-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0989",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-11-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Nagios XI. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Nagios XI",
  "vendor_advisories": [
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Nagios XI nagios-xi",
      "url": "https://www.nagios.com/changelog/nagios-xi/"
    }
  ]
}

CERTFR-2025-AVI-0733

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans Nagios XI. Elle permet à un attaquant de provoquer une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Nagios	Nagios XI	Nagios XI versions antérieures à 2024R2.1

References

Title

Publication Time

Tags

2025-08-27

vendor-advisory

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Nagios XI versions ant\u00e9rieures \u00e0 2024R2.1",
      "product": {
        "name": "Nagios XI",
        "vendor": {
          "name": "Nagios",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2025-AVI-0733",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-08-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Nagios XI. Elle permet \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Vuln\u00e9rabilit\u00e9 dans Nagios XI",
  "vendor_advisories": [
    {
      "published_at": "2025-08-27",
      "title": "Bulletin de s\u00e9curit\u00e9 Nagios XI changelog",
      "url": "https://www.nagios.com/changelog/"
    }
  ]
}

CERTFR-2025-AVI-0182

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans Nagios XI. Elle permet à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Nagios	Nagios XI	Nagios XI versions antérieures à 2024R1.4

References

Title

Publication Time

Tags

2025-05-21

vendor-advisory

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Nagios XI versions ant\u00e9rieures \u00e0 2024R1.4",
      "product": {
        "name": "Nagios XI",
        "vendor": {
          "name": "Nagios",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2025-AVI-0182",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-03-07T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Nagios XI. Elle permet \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Nagios XI",
  "vendor_advisories": [
    {
      "published_at": "2025-05-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Nagios XI changelog",
      "url": "https://www.nagios.com/changelog/"
    }
  ]
}

CERTFR-2024-AVI-1075

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans Nagios XI. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Nagios	Nagios XI	Nagios XI versions antérieures à 2024R1.3.2

References

Title

Publication Time

Tags

2024-12-12

vendor-advisory

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Nagios XI versions ant\u00e9rieures \u00e0 2024R1.3.2",
      "product": {
        "name": "Nagios XI",
        "vendor": {
          "name": "Nagios",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2024-AVI-1075",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-12-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Nagios XI. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la politique de s\u00e9curit\u00e9 et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Nagios XI",
  "vendor_advisories": [
    {
      "published_at": "2024-12-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Nagios XI changelog",
      "url": "https://www.nagios.com/changelog/"
    }
  ]
}

CERTFR-2024-AVI-0966

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans Nagios XI. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de requêtes illégitimes par rebond (CSRF) et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Nagios	Nagios XI	Nagios XI versions antérieures à 2024R1.3.1

References

Title

Publication Time

Tags

2024-12-12

vendor-advisory

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Nagios XI versions ant\u00e9rieures \u00e0 2024R1.3.1",
      "product": {
        "name": "Nagios XI",
        "vendor": {
          "name": "Nagios",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2024-AVI-0966",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-11-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Nagios XI. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF) et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Nagios XI",
  "vendor_advisories": [
    {
      "published_at": "2024-12-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Nagios XI changelog",
      "url": "https://www.nagios.com/changelog/"
    }
  ]
}

CERTFR-2024-AVI-0805

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans Nagios XI. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Nagios	Nagios XI	Nagios XI versions antérieures à 2024R1.2.2

References

Title

Publication Time

Tags

2024-12-12

vendor-advisory

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Nagios XI versions ant\u00e9rieures \u00e0 2024R1.2.2",
      "product": {
        "name": "Nagios XI",
        "vendor": {
          "name": "Nagios",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2024-AVI-0805",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-09-25T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Nagios XI. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Nagios XI",
  "vendor_advisories": [
    {
      "published_at": "2024-12-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Nagios XI changelog",
      "url": "https://www.nagios.com/changelog/"
    }
  ]
}

CERTFR-2024-AVI-0675

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans Nagios XI. Elles permettent à un attaquant de provoquer une élévation de privilèges, un contournement de la politique de sécurité et un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Nagios	Nagios XI	Nagios XI versions antérieures à 2024R1.2

References

Title

Publication Time

Tags

2024-12-12

vendor-advisory

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Nagios XI versions ant\u00e9rieures \u00e0 2024R1.2",
      "product": {
        "name": "Nagios XI",
        "vendor": {
          "name": "Nagios",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2024-AVI-0675",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-08-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Nagios XI. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un contournement de la politique de s\u00e9curit\u00e9 et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Nagios XI",
  "vendor_advisories": [
    {
      "published_at": "2024-12-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Nagios XI changelog",
      "url": "https://www.nagios.com/changelog/"
    }
  ]
}

CERTFR-2024-AVI-0621

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans Nagios XI. Elle permet à un attaquant de provoquer une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Nagios	Nagios XI	Nagios XI versions antérieures à 2024R1.1.5

References

Title

Publication Time

Tags

2024-12-12

vendor-advisory

Bulletin de sécurité Nagios XI

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Nagios XI versions ant\u00e9rieures \u00e0 2024R1.1.5",
      "product": {
        "name": "Nagios XI",
        "vendor": {
          "name": "Nagios",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2024-AVI-0621",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-07-24T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Nagios XI. Elle permet \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Vuln\u00e9rabilit\u00e9 dans Nagios XI",
  "vendor_advisories": [
    {
      "published_at": "2024-12-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Nagios XI changelog",
      "url": "https://www.nagios.com/changelog/"
    }
  ]
}

CERTFR-2024-AVI-0448

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans Nagios XI. Elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Nagios	Nagios XI	Nagios XI versions antérieures à 2024R1.1.3

References

Title

Publication Time

Tags

2024-05-28

vendor-advisory

Bulletin de sécurité NagiosXI

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Nagios XI versions ant\u00e9rieures \u00e0 2024R1.1.3",
      "product": {
        "name": "Nagios XI",
        "vendor": {
          "name": "Nagios",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2024-AVI-0448",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-05-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Nagios XI. Elles permettent \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Nagios XI",
  "vendor_advisories": [
    {
      "published_at": "2024-05-28",
      "title": "Bulletin de s\u00e9curit\u00e9 Nagios XI",
      "url": "https://www.nagios.com/changelog/"
    }
  ]
}

CERTFR-2024-AVI-0342

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans NagiosXI. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur et une atteinte à l'intégrité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Nagios	Nagios XI	NagiosXI versions antérieures à 2024R1.1.2

References

Title

Publication Time

Tags

2024-04-23

vendor-advisory

Bulletin de sécurité Nagios XI du 26 mars 2024

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "NagiosXI versions ant\u00e9rieures \u00e0 2024R1.1.2",
      "product": {
        "name": "Nagios XI",
        "vendor": {
          "name": "Nagios",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2024-AVI-0342",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-04-24T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans NagiosXI. Elles\npermettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non\nsp\u00e9cifi\u00e9 par l\u0027\u00e9diteur et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans NagiosXI",
  "vendor_advisories": [
    {
      "published_at": "2024-04-23",
      "title": "Bulletin de s\u00e9curit\u00e9 NagiosXI",
      "url": "https://www.nagios.com/changelog/"
    }
  ]
}

CERTFR-2024-AVI-0252

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans Nagios XI. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur et une injection de code indirecte à distance (XSS).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Nagios	Nagios XI	Nagios XI versions antérieures à 2024R1.1

References

Title

Publication Time

Tags

None

vendor-advisory

Bulletin de sécurité Nagios XI 2024R1 du 06 décembre 2023

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Nagios XI versions ant\u00e9rieures \u00e0 2024R1.1",
      "product": {
        "name": "Nagios XI",
        "vendor": {
          "name": "Nagios",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2024-AVI-0252",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-03-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Nagios XI. Elles\npermettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non\nsp\u00e9cifi\u00e9 par l\u0027\u00e9diteur et une injection de code indirecte \u00e0 distance\n(XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Nagios XI",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Nagios XI du 26 mars 2024",
      "url": "https://www.nagios.com/changelog/"
    }
  ]
}

CERTFR-2023-AVI-1004

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans Nagios XI. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur et une injection de code indirecte à distance (XSS).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Nagios	Nagios XI	Nagios XI sans le correctif de sécurité 2024R1

References

Title

Publication Time

Tags

None

vendor-advisory

Bulletin de sécurité Nagios XI 5.11.3 du 01 novembre 2023

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Nagios XI sans le correctif de s\u00e9curit\u00e9 2024R1",
      "product": {
        "name": "Nagios XI",
        "vendor": {
          "name": "Nagios",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2023-AVI-1004",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-12-07T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Nagios XI. Elles\npermettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non\nsp\u00e9cifi\u00e9 par l\u0027\u00e9diteur et une injection de code indirecte \u00e0 distance\n(XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Nagios XI",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Nagios XI 2024R1 du 06 d\u00e9cembre 2023",
      "url": "https://www.nagios.com/changelog/"
    }
  ]
}

CERTFR-2023-AVI-0900

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans Nagios XI. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une injection de code indirecte à distance (XSS).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Nagios	Nagios XI	Nagios XI versons antérieures à 5.11.3

References

Title

Publication Time

Tags

None

vendor-advisory

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Nagios XI versons ant\u00e9rieures \u00e0 5.11.3",
      "product": {
        "name": "Nagios XI",
        "vendor": {
          "name": "Nagios",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2023-AVI-0900",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-11-02T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Nagios XI.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une injection de code indirecte \u00e0 distance\n(XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Nagios XI",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Nagios XI 5.11.3 du 01 novembre 2023",
      "url": "https://www.nagios.com/change-log/"
    }
  ]
}

CVE-2025-34227 (GCVE-0-2025-34227)

Vulnerability from cvelistv5 – Published: 2025-09-25 17:08 – Updated: 2025-11-17 18:21

Title

Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection

Summary

Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.

Severity ?

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

VulnCheck

References

URL

Tags

	https://www.nagios.com/changelog/	vendor-advisorypatch
	https://www.nagios.com/products/security/	vendor-advisorypatch
	https://www.vulncheck.com/advisories/nagios-xi-co…	third-party-advisory
	https://theyhack.me/CVE-2025-34227-Nagios-XI-Wiza…	technical-descriptionexploit

Impacted products

	Vendor	Product	Version
	Nagios	Nagios XI	Affected: * , < 2026R1 (semver)

Credits

M. Cory Billington of theyhack.me

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-34227",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-25T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-26T03:55:16.630Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Configuration Wizard (/config/monitoringwizard.php)"
          ],
          "product": "Nagios XI",
          "vendor": "Nagios",
          "versions": [
            {
              "lessThan": "2026R1",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nagios:nagios_xi:2026:*:*:*:*:*:*:*",
                  "versionEndExcluding": "r1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "M. Cory Billington of theyhack.me"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eNagios XI \u0026lt; 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Nagios XI \u003c 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-17T18:21:50.807Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.nagios.com/changelog/"
        },
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.nagios.com/products/security/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nagios-xi-config-wizard-auth-command-injection"
        },
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://theyhack.me/CVE-2025-34227-Nagios-XI-Wizard-Command-Injection/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Nagios XI \u003c 2026R1 Configuration Wizard Authenticated Command Injection",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34227",
    "datePublished": "2025-09-25T17:08:52.921Z",
    "dateReserved": "2025-04-15T19:15:22.574Z",
    "dateUpdated": "2025-11-17T18:21:50.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-13986 (GCVE-0-2024-13986)

Vulnerability from cvelistv5 – Published: 2025-08-28 15:49 – Updated: 2025-11-17 18:21

Title

Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE

Summary

Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file paths and extensions during MIB upload and snapshot rename operations. Exploitation results in the placement of attacker-controlled PHP files in a web-accessible directory, executed as the www-data user.

Severity ?

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck

References

URL

Tags

	https://theyhack.me/Nagios-XI-Authenticated-RCE	technical-descriptionexploit
	https://www.nagios.com/changelog/nagios-xi/	vendor-advisorypatch
	https://www.nagios.com/products/security/#nagios-xi	vendor-advisorypatch
	https://www.vulncheck.com/advisories/nagios-xi-au…	third-party-advisory

Impacted products

	Vendor	Product	Version
	Nagios	Nagios XI	Affected: * , < 2024R1.3.2 (semver)

Credits

M. Cory Billington of theyhack.me

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-13986",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-28T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-29T03:55:25.691Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://theyhack.me/Nagios-XI-Authenticated-RCE/"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "MIB Upload (/admin/mibs.php)",
            "Snapshot Rename (/admin/coreconfigsnapshots.php)"
          ],
          "product": "Nagios XI",
          "vendor": "Nagios",
          "versions": [
            {
              "lessThan": "2024R1.3.2",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:*:*:*:*:*:*:*",
                  "versionEndExcluding": "r1.3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "M. Cory Billington of theyhack.me"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Nagios XI \u0026lt; 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file paths and extensions during MIB upload and snapshot rename operations. Exploitation results in the placement of attacker-controlled PHP files in a web-accessible directory, executed as the www-data user."
            }
          ],
          "value": "Nagios XI \u003c 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file paths and extensions during MIB upload and snapshot rename operations. Exploitation results in the placement of attacker-controlled PHP files in a web-accessible directory, executed as the www-data user."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-137",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-137 Parameter Injection"
            }
          ]
        },
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-17T18:21:46.809Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://theyhack.me/Nagios-XI-Authenticated-RCE"
        },
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.nagios.com/changelog/nagios-xi/"
        },
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.nagios.com/products/security/#nagios-xi"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nagios-xi-authenticated-arbitrary-file-upload-path-traversal-rce"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Nagios XI \u003c 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-13986",
    "datePublished": "2025-08-28T15:49:46.119Z",
    "dateReserved": "2025-08-28T15:35:33.691Z",
    "dateUpdated": "2025-11-17T18:21:46.809Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-34227 (GCVE-0-2025-34227)

Vulnerability from nvd – Published: 2025-09-25 17:08 – Updated: 2025-11-17 18:21

Title

Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection

Summary

Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.

Severity ?

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

VulnCheck

References

URL

Tags

	https://www.nagios.com/changelog/	vendor-advisorypatch
	https://www.nagios.com/products/security/	vendor-advisorypatch
	https://www.vulncheck.com/advisories/nagios-xi-co…	third-party-advisory
	https://theyhack.me/CVE-2025-34227-Nagios-XI-Wiza…	technical-descriptionexploit

Impacted products

	Vendor	Product	Version
	Nagios	Nagios XI	Affected: * , < 2026R1 (semver)

Credits

M. Cory Billington of theyhack.me

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-34227",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-25T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-26T03:55:16.630Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Configuration Wizard (/config/monitoringwizard.php)"
          ],
          "product": "Nagios XI",
          "vendor": "Nagios",
          "versions": [
            {
              "lessThan": "2026R1",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nagios:nagios_xi:2026:*:*:*:*:*:*:*",
                  "versionEndExcluding": "r1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "M. Cory Billington of theyhack.me"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eNagios XI \u0026lt; 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Nagios XI \u003c 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-17T18:21:50.807Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.nagios.com/changelog/"
        },
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.nagios.com/products/security/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nagios-xi-config-wizard-auth-command-injection"
        },
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://theyhack.me/CVE-2025-34227-Nagios-XI-Wizard-Command-Injection/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Nagios XI \u003c 2026R1 Configuration Wizard Authenticated Command Injection",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34227",
    "datePublished": "2025-09-25T17:08:52.921Z",
    "dateReserved": "2025-04-15T19:15:22.574Z",
    "dateUpdated": "2025-11-17T18:21:50.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-13986 (GCVE-0-2024-13986)

Vulnerability from nvd – Published: 2025-08-28 15:49 – Updated: 2025-11-17 18:21

Title

Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE

Summary

Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file paths and extensions during MIB upload and snapshot rename operations. Exploitation results in the placement of attacker-controlled PHP files in a web-accessible directory, executed as the www-data user.

Severity ?

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck

References

URL

Tags

	https://theyhack.me/Nagios-XI-Authenticated-RCE	technical-descriptionexploit
	https://www.nagios.com/changelog/nagios-xi/	vendor-advisorypatch
	https://www.nagios.com/products/security/#nagios-xi	vendor-advisorypatch
	https://www.vulncheck.com/advisories/nagios-xi-au…	third-party-advisory

Impacted products

	Vendor	Product	Version
	Nagios	Nagios XI	Affected: * , < 2024R1.3.2 (semver)

Credits

M. Cory Billington of theyhack.me

Show details on NVD website