PT-2014-2573 · Nagios+1 · Nagios+1

Vincent Danen · Published 2014-02-10 · Updated 2024-06-15 · CVE-2013-2214

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nagios versions 3.x through 3.5.0 Nagios versions 4.0 through 4.0 beta3

Description The issue allows remote authenticated users to obtain sensitive information about hostnames via the servicegroup overview, summary, or grid style in status.cgi. This behavior was initially by design in most 3.x versions, but the upstream vendor decided to change it for Nagios 4 and version 3.5.1.

Recommendations For Nagios versions 3.x through 3.5.0, update to version 3.5.1 or later. For Nagios versions 4.0 through 4.0 beta3, update to version 4.0 beta4 or later.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2017-2354

CVE-2013-2214

OPENSUSE-SU-2024:11073-1

Affected Products

Alt Linux

Nagios

References · 41

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/nagios3_history_cgi.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/nagios3_statuswml_ping.rb · Exploit
• http://lists.opensuse.org/opensuse-updates/2013-07/msg00029.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03479 · Security Note
• http://tracker.nagios.org/view.php?id=456 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-07/msg00031.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1523 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-2214 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11073-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6096 · Security Note
• https://errata.altlinux.org/ALT-PU-2017-2354 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7205 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7108 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2288 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2214 · Security Note