PT-2025-44477 · Nagios · Nagios Xi+1

Published 2025-10-30 · Updated 2025-10-30 · CVE-2021-47693

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to CCM 3.1.3 Nagios XI versions prior to 5.8.5

Description The Core Config Manager (CCM) contains a SQL injection issue in how search text is handled. User-supplied input is not properly sanitized before being used in SQL queries within configuration object editors. A successful exploit by an authenticated user could result in the unauthorized disclosure or modification of configuration and application data, potentially leading to further compromise of the application or backend database.

Recommendations Update to CCM version 3.1.3 or later. Update to Nagios XI version 5.8.5 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-47693

Affected Products

Core Config Manager

Nagios Xi

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-47693 · Security Note
• https://osv.dev/vulnerability/CVE-2021-47693 · Vendor Advisory
• https://nagios.com/changelog/nagios-xi · Patch
• https://twitter.com/CVEnew/status/1984015888383705465 · Twitter Post
• https://vulncheck.com/advisories/nagios-xi-ccm-sqli-via-improper-escaping-in-search-text · Note