CyberSec.Space Logo
Back to CVE Browser

CVE-2018-17148

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.1850%
EPSS Percentile4.24th
PublishedJun 19, 2019
Last ModifiedNov 21, 2024

Vulnerability Description

An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote attackers to gain access to configuration files containing confidential credentials.

Affected Platforms (CPE)

📦
Nagios

Nagios Xi

< 5.5.4

References & Advisories

🔗 https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT
🔗 https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT

Related Vulnerabilities

CVE-2002-195910.0

Nagios 1.0b1 through 1.0b3 allows remote attackers to execute arbitrary commands via shell metacharacters in plugin output.

CVE-2019-92049.8

SQL injection vulnerability in Nagios IM (component of Nagios XI) before 2.2.7 allows attackers to execute arbitrary SQL commands.

CVE-2019-91659.8

SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using f...

CVE-2019-92039.8

Authorization bypass in Nagios IM (component of Nagios XI) before 2.2.7 allows closing incidents in IM via the API.