Threats tagged 'ghsa-gvrp-ffhh-698m'

Nagios XI versions prior to 2024R2 include a script named process_perfdata.pl that is improperly owned and writable by the web server user (www-data). This script is executed periodically as the nagios user. Because of this misconfiguration, an attacker with web server privileges can modify the script to execute arbitrary code with nagios user privileges, resulting in local privilege escalation.