| Vulnerability Name: | CCN-113781 | ||||||
| Published: | 2016-06-02 | ||||||
| Updated: | 2016-06-02 | ||||||
| Summary: | Nagios XI could allow a remote authenticated attacker to gain elevated privileges on the system, caused by an insecure implementation of the applicationÂ’s component upload functionality. An attacker could exploit this vulnerability to execute getprofile.sh script with root privileges. | ||||||
| CVSS v3 Severity: | 9.8 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 9.1 Critical (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
| ||||||
| CVSS v2 Severity: | 10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
| ||||||
| Vulnerability Consequences: | Gain Privileges | ||||||
| References: | Source: CCN Type: Full-Disclosure Mailing List, Thu, 2 Jun 2016 11:50:39 +1200 Nagios XI Multiple Vulnerabilities Source: XF Type: UNKNOWN nagiosxi-profile-priv-esc(113781) Source: CCN Type: Packet Storm Security [06-02-2016] Nagios XI 5.2.7 Code Execution / SQL Injection / Privilege Escalation Nagios XI 5.2.7 Code Execution / SQL Injection / Privilege Escalation Nagios XI 5.2.7 Code Execution / SQL Injection / Privilege Escalation Source: CCN Type: Packet Storm Security [07-06-2016] Nagios XI Chained Remote Code Execution Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [06-06-2016] Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [07-06-2016] Source: CCN Type: Nagios Web site Nagios - Network, Server and Log Monitoring Software | ||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||
| BACK | |||||||