CVE-2024-14002

Опубликовано: 30 окт. 2025

Источник: nvd

CVSS3: 5.5

EPSS Низкий

Описание

Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An authenticated user can supply crafted path values that cause the server to include local files, potentially exposing sensitive information from the underlying host.

Ссылки

https://www.nagios.com/changelog/nagios-xi/
Release Notes
https://www.nagios.com/products/security/#nagios-xi
Vendor Advisory
https://www.vulncheck.com/advisories/nagios-xi-authenticated-local-file-inclusion-via-nagvis
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*

Версия до 2024 (исключая)

cpe:2.3:a:nagios:nagios_xi:2024:r1:*:*:*:*:*:*

cpe:2.3:a:nagios:nagios_xi:2024:r1.0.1:*:*:*:*:*:*

cpe:2.3:a:nagios:nagios_xi:2024:r1.0.2:*:*:*:*:*:*

cpe:2.3:a:nagios:nagios_xi:2024:r1.1:*:*:*:*:*:*

cpe:2.3:a:nagios:nagios_xi:2024:r1.1.1:*:*:*:*:*:*

cpe:2.3:a:nagios:nagios_xi:2024:r1.1.2:*:*:*:*:*:*

cpe:2.3:a:nagios:nagios_xi:2024:r1.1.3:*:*:*:*:*:*

EPSS

Процентиль: 66%

0.012

Низкий

5.5 Medium

CVSS3

Дефекты

CWE-98

Связанные уязвимости

GHSA-qwgp-62r6-68mw

CVSS3: 5.5

github

10 месяцев назад

BDU:2025-14536

CVSS3: 6.5

fstec