Threats tagged 'ghsa-7h56-968g-xcq3'

Nagios XI versions prior to 2024R1.4.2 have a remote code execution vulnerability in the Business Process Intelligence (BPI) component. This flaw arises from insufficient validation and sanitization of administrator-controlled BPI configuration parameters, allowing an authenticated admin to create or overwrite files within the webroot. If these files have executable extensions, arbitrary code execution can occur with the privileges of the Nagios XI web application user, potentially leading to further system compromise.