CVE-2020-28648

Exploit

EPSS 13.91%
Published 16.11.2020 03:15:12
Last modified 21.11.2024 05:23:06
Source cve@mitre.org
Teams watchlist Login
Open Login

Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code.

Affected products Warnungen 0 Metrics 3 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Nagios ≫ Nagios Xi Version < 5.7.5

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	13.91%	0.94

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	9	8	10	AV:N/AC:L/Au:S/C:C/I:C/A:C

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://www.nagios.com/downloads/nagios-xi/change-log/

Vendor Advisory

Release Notes

http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html

Third Party Advisory

Exploit

VDB Entry

https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/

Third Party Advisory

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2020-28648

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-28648

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-28648

EUVD