PT-2019-9394 · Nagios · Nagios Xi

Published 2019-06-19 · Updated 2019-06-21 · CVE-2018-17148

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.5.4

Description The issue is related to insufficient access control, which can lead to credential disclosure. It affects the configuration snapshot page, specifically the coreconfigsnapshot.php file, allowing remote attackers to access configuration files that contain confidential credentials.

Recommendations For versions prior to 5.5.4, update to version 5.5.4 or later to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2018-17148

Affected Products

Nagios Xi

References · 3

• https://osv.dev/vulnerability/CVE-2018-17148 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17148 · Security Note
• https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT · Vendor Advisory