Improper Neutralization of Special Elements in Output Used by a Downstream Component in Nagios - CVE-2020-13977

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU34362

Improper Neutralization of Special Elements in Output Used by a Downstream Component in Nagios - CVE-2020-13977

Published: June 9, 2020 / Updated: August 8, 2020


Vulnerability identifier: #VU34362
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-13977
CWE-ID: CWE-74
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote privileged user to manipulate data.

Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been mistakenly associated with CVE-2020-1408.


Affected software

Nagios
Fedora
nagios

How to mitigate CVE-2020-13977

Install update from vendor's website.

nagios - addressed in versions 4.4.6-1.el8, 4.4.6-1.fc32, 4.4.6-1.fc33, 4.4.6-2.el7, 4.4.6-3.el7, 4.4.6-3.el8, 4.4.6-3.fc32, 4.4.6-3.fc33, 4.4.6-3.fc34, 4.4.6-4.el7, 4.4.6-4.el8, 4.4.6-4.fc34

External References

Related Security Bulletins