PT-2021-11594 · Nagios · Nagios Fusion+1

Published 2021-05-24 · Updated 2021-05-28 · CVE-2020-28900

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Nagios Fusion versions 4.1.8 and earlier Nagios XI versions 5.7.5 and earlier

Description: The issue is related to insufficient verification of data authenticity, which can lead to escalation of privileges or code execution as root. This is possible via vectors related to an untrusted update package to upgrade to latest.sh.

Recommendations: For Nagios Fusion versions 4.1.8 and earlier, update to a version later than 4.1.8 to resolve the issue. For Nagios XI versions 5.7.5 and earlier, update to a version later than 5.7.5 to resolve the issue. As a temporary workaround, consider restricting access to the upgrade to latest.sh script until a patch is available.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2020-28900

Affected Products

Nagios Fusion

Nagios Xi

References · 5

• 🔥 https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-28900 · Security Note
• https://nagios.com/downloads/nagios-xi/change-log · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28900 · Vendor Advisory
• http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html · Note