CVE-2020-5791

Опубликовано: 20 окт. 2020

Источник: nvd

CVSS3: 7.2

CVSS2: 9

EPSS Высокий

Описание

Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.

Ссылки

http://packetstormsecurity.com/files/159743/Nagios-XI-5.7.3-Remote-Command-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/162235/Nagios-XI-5.7.3-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
https://www.tenable.com/security/research/tra-2020-58
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/159743/Nagios-XI-5.7.3-Remote-Command-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/162235/Nagios-XI-5.7.3-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
https://www.tenable.com/security/research/tra-2020-58
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*

Версия от 5.6.0 (включая) до 5.7.3 (включая)

EPSS

Процентиль: 99%

0.87753

Высокий

7.2 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-2j39-6c38-r3mx