PT-2025-44465 · Nagios Enterprises · Nagios Xi+1

Matthew Aberegg · Published 2025-10-30 · Updated 2025-10-30 · CVE-2020-36859

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to CCM 3.0.7 Nagios XI versions prior to 5.7.4

Description The Core Config Manager (CCM) in Nagios XI has multiple SQL injection flaws present in the object edit pages. The application incorporates unsanitized user-supplied input into SQL queries used by configuration object editors. Successful exploitation could lead to unauthorized disclosure or modification of configuration and application data, and potentially further compromise of the application or backend database. The issue affects authenticated users.

Recommendations Update to CCM version 3.0.7 or later. Update to Nagios XI version 5.7.4 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-36859

Affected Products

Core Config Manager

Nagios Xi

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-36859 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36859 · Vendor Advisory
• https://nagios.com/changelog/nagios-xi · Patch
• https://twitter.com/CVEnew/status/1984015887368630661 · Twitter Post
• https://vulncheck.com/advisories/nagios-xi-ccm-sqli-via-object-edit-pages · Note