CVE-2018-8734

Опубликовано: 18 апр. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Высокий

Описание

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter.

Ссылки

https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT
Release Notes
Vendor Advisory
https://blog.redactedsec.net/exploits/2018/04/26/nagios.html
Exploit
Technical Description
Third Party Advisory
https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f
Third Party Advisory
https://www.exploit-db.com/exploits/44560/
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/44969/
Exploit
Third Party Advisory
VDB Entry
https://www.nagios.com/downloads/nagios-xi/change-log/
Release Notes
Vendor Advisory
https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT
Release Notes
Vendor Advisory
https://blog.redactedsec.net/exploits/2018/04/26/nagios.html
Exploit
Technical Description
Third Party Advisory
https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f
Third Party Advisory
https://www.exploit-db.com/exploits/44560/
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/44969/
Exploit
Third Party Advisory
VDB Entry
https://www.nagios.com/downloads/nagios-xi/change-log/
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*

Версия от 5.2.0 (включая) до 5.4.13 (исключая)

EPSS

Процентиль: 99%

0.79015

Высокий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

CVE-2018-8734

CVSS3: 9.8

ubuntu

почти 8 лет назад

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter.

GHSA-r9pv-w7cx-x2rm

CVSS3: 9.8

github

больше 3 лет назад

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter.

EPSS

Процентиль: 99%

0.79015

Высокий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89