PT-2021-11598 · Nagios · Nagios Fusion

Published 2021-05-24 · Updated 2021-06-03 · CVE-2020-28907

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Nagios Fusion versions 4.1.8 and earlier

Description: The issue is related to incorrect SSL certificate validation, which can lead to escalation of privileges or code execution as root. This is possible via vectors related to the download of an untrusted update package in the upgrade to latest.sh script.

Recommendations: For Nagios Fusion versions 4.1.8 and earlier, update to a version that includes the fix for the incorrect SSL certificate validation issue to prevent escalation of privileges or code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-28907

Affected Products

Nagios Fusion

References · 5

• 🔥 https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you · Exploit
• https://nagios.com/downloads/nagios-xi/change-log · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28907 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28907 · Security Note
• http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html · Note