CyberSec.Space Logo
CVEブラウザに戻る

CVE-2018-17148

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.1850%
EPSS Percentile4.24th
Published2019年6月19日
Last Modified2024年11月21日

Vulnerability Description

An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote attackers to gain access to configuration files containing confidential credentials.

Affected Platforms (CPE)

📦
Nagios

Nagios Xi

< 5.5.4

References & Advisories

🔗 https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT
🔗 https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT

関連する脆弱性情報

CVE-2002-195910.0

Nagios 1.0b1 through 1.0b3 allows remote attackers to execute arbitrary commands via shell metacharacters in plugin output.

CVE-2019-92049.8

SQL injection vulnerability in Nagios IM (component of Nagios XI) before 2.2.7 allows attackers to execute arbitrary SQL commands.

CVE-2019-91659.8

SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using f...

CVE-2019-92039.8

Authorization bypass in Nagios IM (component of Nagios XI) before 2.2.7 allows closing incidents in IM via the API.