vendor:
Nagios XI Network Monitor
by:
Daniel Compton
7.5
CVSS
HIGH
Command Injection
CWE
Product Name: Nagios XI Network Monitor
Affected Version From:
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested: unix
2012
Nagios XI Network Monitor Graph Explorer Component Command Injection
This module exploits a vulnerability found in Nagios XI Network Monitor's component 'Graph Explorer'. An authenticated user can execute system commands by injecting it in several parameters, such as in visApi.php's 'host' parameter, which results in remote code execution.
Mitigation:
Update to the latest version of Nagios XI Network Monitor.
