PT-2023-5388 · Nagios Xi · Nagios Xi

Astrid Tedenbrant

·

Published

2023-08-04

·

Updated

2023-09-27

·

CVE-2023-40931

CVSS v2.0

6.8

Medium

VectorAV:N/AC:L/Au:S/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions Nagios XI versions 5.11.0 through 5.11.1
Description A SQL injection issue allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to "/nagiosxi/admin/banner message-ajaxhelper.php". This vulnerability can be exploited by remote attackers to disclose protected information.
Recommendations For Nagios XI versions 5.11.0 through 5.11.1, consider disabling the banner message-ajaxhelper.php script until a patch is available. Restrict access to the /nagiosxi/admin/banner message-ajaxhelper.php endpoint to minimize the risk of exploitation. Avoid using the ID parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-06016
CVE-2023-40931

Affected Products

Nagios Xi