4

CVE-2013-2214

status.cgi in Nagios 4.0 before 4.0 beta4 and 3.x before 3.5.1 does not properly restrict access to certain users that are a contact for a service, which allows remote authenticated users to obtain sensitive information about hostnames via the servicegroup (1) overview, (2) summary, or (3) grid style in status.cgi.  NOTE: this behavior is by design in most 3.x versions, but the upstream vendor "decided to change it for Nagios 4" and 3.5.1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nagios ≫ Nagios Version 3.0
Nagios ≫ Nagios Version 3.0 Update alpha1
Nagios ≫ Nagios Version 3.0 Update alpha2
Nagios ≫ Nagios Version 3.0 Update alpha3
Nagios ≫ Nagios Version 3.0 Update alpha4
Nagios ≫ Nagios Version 3.0 Update alpha5
Nagios ≫ Nagios Version 3.0 Update beta1
Nagios ≫ Nagios Version 3.0 Update beta2
Nagios ≫ Nagios Version 3.0 Update beta3
Nagios ≫ Nagios Version 3.0 Update beta4
Nagios ≫ Nagios Version 3.0 Update beta5
Nagios ≫ Nagios Version 3.0 Update beta6
Nagios ≫ Nagios Version 3.0 Update beta7
Nagios ≫ Nagios Version 3.0 Update rc1
Nagios ≫ Nagios Version 3.0 Update rc2
Nagios ≫ Nagios Version 3.0 Update rc3
Nagios ≫ Nagios Version 3.0.1
Nagios ≫ Nagios Version 3.0.2
Nagios ≫ Nagios Version 3.0.3
Nagios ≫ Nagios Version 3.0.4
Nagios ≫ Nagios Version 3.0.5
Nagios ≫ Nagios Version 3.0.6
Nagios ≫ Nagios Version 3.1.0
Nagios ≫ Nagios Version 3.1.1
Nagios ≫ Nagios Version 3.1.2
Nagios ≫ Nagios Version 3.2.0
Nagios ≫ Nagios Version 3.2.1
Nagios ≫ Nagios Version 3.2.2
Nagios ≫ Nagios Version 3.2.3
Nagios ≫ Nagios Version 3.3.1
Nagios ≫ Nagios Version 3.4.0
Nagios ≫ Nagios Version 3.4.1
Nagios ≫ Nagios Version 3.4.2
Nagios ≫ Nagios Version 3.4.3
Nagios ≫ Nagios Version 3.4.4
Nagios ≫ Nagios Version 3.5.0
Nagios ≫ Nagios Version 4.0.0 Update beta1
Nagios ≫ Nagios Version 4.0.0 Update beta2
Nagios ≫ Nagios Version 4.0.0 Update beta3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.34% 0.9
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://lists.opensuse.org/opensuse-updates/2013-07/msg00029.html
http://lists.opensuse.org/opensuse-updates/2013-07/msg00031.html
http://seclists.org/oss-sec/2013/q2/619
http://seclists.org/oss-sec/2013/q2/622
http://tracker.nagios.org/view.php?id=456
Vendor Advisory