vendor:
Nagiosxi
by:
Calil Khalil
8.1
CVSS
CRITICAL
Remote Code Execution
94
CWE
Product Name: Nagiosxi
Affected Version From: Nagios Xi 5.6.6
Affected Version To: Nagios Xi 5.6.6
Patch Exists: YES
Related CWE: CVE-2019-15949
CPE: a:nagios:nagiosxi:5.6.6
Other Scripts:
https://www.infosecmatter.com/metasploit-module-library/?mm=auxiliary/scanner/http/nagios_xi_scanner, https://www.infosecmatter.com/metasploit-module-library/?mm=exploit/linux/http/nagios_xi_plugins_check_plugin_authenticated_rce, https://www.infosecmatter.com/list-of-metasploit-linux-exploits-detailed-spreadsheet/, https://www.infosecmatter.com/metasploit-auxiliary-modules-detailed-spreadsheet/
Platforms Tested: Ubuntu
2024
Nagiosxi Authenticated Remote Code Execution
The Nagiosxi 5.6.6 allows authenticated remote attackers to execute arbitrary code by uploading a malicious check ping plugin. By exploiting this vulnerability, an attacker can gain unauthorized access to the target system.
Mitigation:
To mitigate this vulnerability, it is recommended to update Nagiosxi to a patched version where this issue has been resolved.
