PT-2023-5388 · Nagios Xi · Nagios Xi

Astrid Tedenbrant

·

Publicado

2023-08-04

·

Atualizado

2023-09-27

·

CVE-2023-40931

CVSS v2.0

6.8

Média

VetorAV:N/AC:L/Au:S/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions Nagios XI versions 5.11.0 through 5.11.1
Description A SQL injection issue allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to "/nagiosxi/admin/banner message-ajaxhelper.php". This vulnerability can be exploited by remote attackers to disclose protected information.
Recommendations For Nagios XI versions 5.11.0 through 5.11.1, consider disabling the banner message-ajaxhelper.php script until a patch is available. Restrict access to the /nagiosxi/admin/banner message-ajaxhelper.php endpoint to minimize the risk of exploitation. Avoid using the ID parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2023-06016
CVE-2023-40931

Produtos afetados

Nagios Xi