PT-2022-19513 · Nagios Xi · Nagios Xi

Published 2022-06-29 · Updated 2023-08-08 · CVE-2022-29271

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nagios XI versions 5.8.5 and earlier

Description The issue allows a read-only Nagios user to schedule downtime for any host or services due to an incorrect permission check. This enables an attacker to permanently disable all monitoring checks.

Recommendations For Nagios XI versions 5.8.5 and earlier, update to a version later than 5.8.5 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-29271

Affected Products

Nagios Xi

References · 8

• 🔥 https://github.com/sT0wn-nl/CVEs/blob/master/README.md#nagios-xi · Exploit
• 🔥 https://github.com/4LPH4-NL/CVEs · Exploit
• https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29271 · Vendor Advisory
• https://nagios.com/downloads/nagios-xi/change-log · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29271 · Security Note
• https://t.me/cvenotify/32758 · Telegram Post
• https://t.me/cvenotify/32345 · Telegram Post