PT-2021-3329 · Nagios Xi · Nagios Xi

Published 2021-06-07 · Updated 2021-06-15 · CVE-2021-3277

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nagios XI versions 5.7.5 and earlier

Description The issue is related to unlimited file upload of dangerous types in the Nagios XI monitoring tool. Exploitation of this issue may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability is due to improper validation of the rename functionality in the custom-includes component, which allows authenticated admins to upload arbitrary files, potentially leading to remote code execution by uploading php files.

Recommendations For Nagios XI versions 5.7.5 and earlier, consider restricting access to the custom-includes component to minimize the risk of exploitation. As a temporary workaround, avoid using the rename functionality in the custom-includes component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2021-03126

CVE-2021-3277

Affected Products

Nagios Xi

References · 4

• https://osv.dev/vulnerability/CVE-2021-3277 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3277 · Security Note
• https://bdu.fstec.ru/vul/2021-03126 · Security Note
• https://asaf.me/2021/01/21/nagios-xi-5-7-5-remote-code-execution · Note