{"vulnerability": "cve-2020-35578", "sightings": [{"uuid": "f2f4bb35-7d1b-4c96-aae3-4b5da9b623da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35578", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "bbaab0fc-a35a-4d9b-9daa-57f48b97175a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35578", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:28.000000Z"}, {"uuid": "238e4442-7d49-4eea-86f5-ae7ecf3495a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35578", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nagios_xi_scanner.rb", "content": "", "creation_timestamp": "2021-03-26T23:19:21.000000Z"}, {"uuid": "1dfb9a2c-e4a7-49fa-ab5c-0e7094800916", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35578", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_plugins_filename_authenticated_rce.rb", "content": "", "creation_timestamp": "2021-04-14T22:07:13.000000Z"}, {"uuid": "24ac2361-0aac-41b7-b5d4-7b269767bf3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35578", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/530", "content": "CVE-2020-35578 Nagios XI \u9060\u7a0b\u547d\u4ee4\u57f7\u884c\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2020-35578_Nagios_XI_%E9%81%A0%E7%A8%8B%E5%91%BD%E4%BB%A4%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-05-30T02:20:59.000000Z"}, {"uuid": "3ce7a8e8-9de9-4ebe-b54b-22415a6ab423", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35578", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nagios_xi_scanner.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Erik Wynter\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"The module detects the version of Nagios XI applications and\\n        suggests matching exploit modules based on the version number.\\n        Since Nagios XI applications only reveal the version to authenticated\\n        users, valid credentials for a Nagios XI account are required.\\n        Alternatively, it is possible to provide a specific Nagios XI version\\n        number via the `VERSION` option. In that case, the module simply\\n        suggests matching exploit modules and does not probe the target(s).\", \"disclosure_date\": null, \"fullname\": \"auxiliary/scanner/http/nagios_xi_scanner\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"Nagios XI Scanner\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/http/nagios_xi_scanner.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/nagios_xi_scanner\", \"references\": [\"CVE-2019-15949\", \"CVE-2020-5791\", \"CVE-2020-5792\", \"CVE-2020-35578\", \"CVE-2021-37343\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:38.146777Z"}, {"uuid": "4c3661ab-d52c-498b-bd2a-8648b7d68a6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35578", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_plugins_filename_authenticated_rce.rb", "content": "{\"aliases\": [], \"arch\": \"x86, x64, cmd\", \"author\": [\"Haboob Team\", \"Erik Wynter\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a command injection vulnerability (CVE-2020-35578) in the `/admin/monitoringplugins.php`\\n          page of Nagios XI versions prior to 5.8.0 when uploading plugins. Successful exploitation allows\\n          an authenticated admin user to achieve remote code execution as the `apache` user by uploading\\n          a malicious plugin.\\n\\n          Valid credentials for a Nagios XI admin user are required. This module has\\n          been successfully tested against Nagios versions XI 5.3.0 and 5.7.5, both\\n          running on CentOS 7.\", \"disclosure_date\": \"2020-12-19\", \"fullname\": \"exploit/linux/http/nagios_xi_plugins_filename_authenticated_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 13:20:20 +0000\", \"name\": \"Nagios XI Prior to 5.8.0 - Plugins Filename Authenticated Remote Code Exection\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"first-attempt-fail\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/nagios_xi_plugins_filename_authenticated_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/nagios_xi_plugins_filename_authenticated_rce\", \"references\": [\"CVE-2020-35578\", \"EDB-49422\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Linux (x86/x64)\", \"CMD\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:46.883493Z"}]}