#VU36399 OS Command Injection in Nagios XI - CVE-2018-15711 

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU36399

#VU36399 OS Command Injection in Nagios XI - CVE-2018-15711

Published: November 14, 2018 / Updated: August 8, 2020


Vulnerability identifier: #VU36399
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2018-15711
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Nagios XI
Software vendor:
nagios.org

Description

The vulnerability allows a remote authenticated user to execute arbitrary code.

Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key to execute API calls at elevated privileges.


Remediation

Install update from vendor's website.

External links