Threat database

CVE-2023-7312 is a stored cross-site scripting (XSS) vulnerability in Nagios Fusion versions prior to 4.2.0. It arises from improper input sanitization when configuring Email Settings, allowing attackers with high privileges to inject malicious JavaScript payloads. These payloads execute in the browsers of users who access the affected administrative UI pages. Exploitation requires authenticated access with privileges to modify SMTP/email settings, and user interaction is needed to trigger the payload. The vulnerability has a CVSS score of 6.2, indicating medium severity. No known public exploits exist currently. European organizations using Nagios Fusion for IT infrastructure monitoring should prioritize patching to prevent potential compromise of administrative sessions and data.

Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "message": "Could not stop elasticsearch" is in the API response. This is GL:NLS#474.

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call. This is GL:NLS#475.

Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.

Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file paths and extensions during MIB upload and snapshot rename operations. Exploitation results in the placement of attacker-controlled PHP files in a web-accessible directory, executed as the www-data user.

Nagios XI contains a vulnerability that allows OS command injection on the server. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the available data.

Nagios XI contains a vulnerability identified as CVE-2021-25297 that allows OS command injection on the Nagios XI server. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.

Nagios XI contains a vulnerability identified as CVE-2021-25298 that allows OS command injection on the Nagios XI server. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.

Nagios XI contains a remote code execution vulnerability (CVE-2019-15949) that allows a user to modify the check_plugin executable and execute arbitrary commands as root. This vulnerability has been exploited in the wild and is considered high severity.