5.5

CVE-2013-7108

Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.

Data is provided by the National Vulnerability Database (NVD)
Nagios ≫ Nagios Version <= 4.0.2
Nagios ≫ Nagios Version3.0
Nagios ≫ Nagios Version3.0 Updatealpha1
Nagios ≫ Nagios Version3.0 Updatealpha2
Nagios ≫ Nagios Version3.0 Updatealpha3
Nagios ≫ Nagios Version3.0 Updatealpha4
Nagios ≫ Nagios Version3.0 Updatealpha5
Nagios ≫ Nagios Version3.0 Updatebeta1
Nagios ≫ Nagios Version3.0 Updatebeta2
Nagios ≫ Nagios Version3.0 Updatebeta3
Nagios ≫ Nagios Version3.0 Updatebeta4
Nagios ≫ Nagios Version3.0 Updatebeta5
Nagios ≫ Nagios Version3.0 Updatebeta6
Nagios ≫ Nagios Version3.0 Updatebeta7
Nagios ≫ Nagios Version3.0 Updaterc1
Nagios ≫ Nagios Version3.0 Updaterc2
Nagios ≫ Nagios Version3.0 Updaterc3
Nagios ≫ Nagios Version3.0.1
Nagios ≫ Nagios Version3.0.2
Nagios ≫ Nagios Version3.0.3
Nagios ≫ Nagios Version3.0.4
Nagios ≫ Nagios Version3.0.5
Nagios ≫ Nagios Version3.0.6
Nagios ≫ Nagios Version3.1.0
Nagios ≫ Nagios Version3.1.1
Nagios ≫ Nagios Version3.1.2
Nagios ≫ Nagios Version3.2.0
Nagios ≫ Nagios Version3.2.1
Nagios ≫ Nagios Version3.2.2
Nagios ≫ Nagios Version3.2.3
Nagios ≫ Nagios Version3.3.1
Nagios ≫ Nagios Version3.4.0
Nagios ≫ Nagios Version3.4.1
Nagios ≫ Nagios Version3.4.2
Nagios ≫ Nagios Version3.4.3
Nagios ≫ Nagios Version3.5.1
Icinga ≫ Icinga Version <= 1.8.4
Icinga ≫ Icinga Version0.8.0
Icinga ≫ Icinga Version0.8.1
Icinga ≫ Icinga Version0.8.2
Icinga ≫ Icinga Version0.8.3
Icinga ≫ Icinga Version0.8.4
Icinga ≫ Icinga Version1.0
Icinga ≫ Icinga Version1.0 Updaterc1
Icinga ≫ Icinga Version1.0.1
Icinga ≫ Icinga Version1.0.2
Icinga ≫ Icinga Version1.0.3
Icinga ≫ Icinga Version1.2.0
Icinga ≫ Icinga Version1.2.1
Icinga ≫ Icinga Version1.3.0
Icinga ≫ Icinga Version1.3.1
Icinga ≫ Icinga Version1.4.0
Icinga ≫ Icinga Version1.4.1
Icinga ≫ Icinga Version1.6.0
Icinga ≫ Icinga Version1.6.1
Icinga ≫ Icinga Version1.6.2
Icinga ≫ Icinga Version1.7.0
Icinga ≫ Icinga Version1.7.1
Icinga ≫ Icinga Version1.7.2
Icinga ≫ Icinga Version1.7.3
Icinga ≫ Icinga Version1.7.4
Icinga ≫ Icinga Version1.8.0
Icinga ≫ Icinga Version1.8.1
Icinga ≫ Icinga Version1.8.2
Icinga ≫ Icinga Version1.8.3
Icinga ≫ Icinga Version1.9.0
Icinga ≫ Icinga Version1.9.1
Icinga ≫ Icinga Version1.9.2
Icinga ≫ Icinga Version1.9.3
Icinga ≫ Icinga Version1.10.0
Icinga ≫ Icinga Version1.10.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 52.73% 0.979
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.5 8 4.9
AV:N/AC:L/Au:S/C:P/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.