{"vulnerability": "cve-2020-5791", "sightings": [{"uuid": "7e2895a0-f9d3-4a45-b6ff-da87b6108428", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-5791", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "fda80e72-529a-4677-afee-e832571b3b12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-5791", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:29.000000Z"}, {"uuid": "aedb53a6-bd60-4d67-ad0f-b391cf80fe91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-5791", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_mibs_authenticated_rce.rb", "content": "", "creation_timestamp": "2021-04-16T19:46:06.000000Z"}, {"uuid": "f9f05a69-1e5f-4cf0-98c5-c57acd58962b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-5791", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nagios_xi_scanner.rb", "content": "", "creation_timestamp": "2021-03-26T23:19:21.000000Z"}, {"uuid": "3d65322b-1922-49e1-bf3f-1affac16efcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-5791", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nagios_xi_scanner.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Erik Wynter\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"The module detects the version of Nagios XI applications and\\n        suggests matching exploit modules based on the version number.\\n        Since Nagios XI applications only reveal the version to authenticated\\n        users, valid credentials for a Nagios XI account are required.\\n        Alternatively, it is possible to provide a specific Nagios XI version\\n        number via the `VERSION` option. In that case, the module simply\\n        suggests matching exploit modules and does not probe the target(s).\", \"disclosure_date\": null, \"fullname\": \"auxiliary/scanner/http/nagios_xi_scanner\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"Nagios XI Scanner\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/http/nagios_xi_scanner.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/nagios_xi_scanner\", \"references\": [\"CVE-2019-15949\", \"CVE-2020-5791\", \"CVE-2020-5792\", \"CVE-2020-35578\", \"CVE-2021-37343\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:38.251683Z"}, {"uuid": "daed1cb3-cccd-4742-8f81-b8b26dee1fb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-5791", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_mibs_authenticated_rce.rb", "content": "{\"aliases\": [], \"arch\": \"x86, x64, cmd\", \"author\": [\"Chris Lyne\", \"Matthew Aberegg\", \"Erik Wynter\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits CVE-2020-5791, an OS command injection vulnerability in\\n          `admin/mibs.php` that enables an authenticated user with admin privileges to achieve\\n          remote code execution as either the `apache` user or the `www-data` user on NagiosXI\\n          version 5.6.0 to 5.7.3 inclusive (exact user depends on the version of NagiosXI\\n          installed as well as the OS its installed on).\\n\\n          Valid credentials for a Nagios XI admin user are required. This module has\\n          been successfully tested against Nagios XI 5.7.3 running on CentOS 7.\", \"disclosure_date\": \"2020-10-20\", \"fullname\": \"exploit/linux/http/nagios_xi_mibs_authenticated_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 13:20:20 +0000\", \"name\": \"Nagios XI 5.6.0-5.7.3 - Mibs.php Authenticated Remote Code Exection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/nagios_xi_mibs_authenticated_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/nagios_xi_mibs_authenticated_rce\", \"references\": [\"CVE-2020-5791\", \"EDB-48959\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Linux (x86/x64)\", \"CMD\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:46.709250Z"}]}