PT-2018-18607 · Nagios · Nagios Xi

Published 2018-04-18 · Updated 2019-03-04 · CVE-2018-8735

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nagios XI versions 5.2.x through 5.4.x before 5.4.13

Description A remote command execution issue allows an attacker to execute arbitrary commands on the target system. This is due to an OS command injection flaw.

Recommendations For Nagios XI versions 5.2.x through 5.4.x before 5.4.13, update to version 5.4.13 or later to resolve the issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-8735

Affected Products

Nagios Xi

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_chained_rce_2_electric_boogaloo.rb · Exploit
• 🔥 https://blog.redactedsec.net/exploits/2018/04/26/nagios.html · Exploit
• 🔥 https://exploit-db.com/exploits/44560 · Exploit
• 🔥 https://exploit-db.com/exploits/44969 · Exploit
• 🔥 http://blog.redactedsec.net/exploits/2018/04/26/nagios.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-8735 · Security Note
• https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT · Vendor Advisory
• https://nagios.com/downloads/nagios-xi/change-log · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8735 · Vendor Advisory
• https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f · Note