PT-2022-24313 · Nagios Xi · Nagios Xi

Published 2022-09-07 · Updated 2022-09-09 · CVE-2022-38250

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nagios XI version 5.8.6

Description A SQL injection issue was found in Nagios XI via the mib name parameter at the "Manage MIBs" page.

Recommendations For Nagios XI version 5.8.6, avoid using the mib name parameter in the affected page until the issue is resolved. As a temporary workaround, consider restricting access to the "Manage MIBs" page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-38250

Affected Products

Nagios Xi

References · 8

• https://osv.dev/vulnerability/UBUNTU-CVE-2022-38250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38250 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-38250 · Security Note
• https://nagios.com/downloads/nagios-xi/change-log/#5.8.7 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-38250 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-38250 · Vendor Advisory
• https://t.me/cibsecurity/49419 · Telegram Post
• https://t.me/cvenotify/35832 · Telegram Post