PT-2025-44480 · Nagios Enterprises · Nagios Xi

Published 2025-10-30 · Updated 2025-10-30 · CVE-2021-47700

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.8.7

Description Nagios XI used a temporary directory for Highcharts exports with overly permissive ownership and permissions under the Apache user. This allowed local or co-hosted processes to read or overwrite export artifacts, or manipulate paths. Depending on the deployment, this could lead to disclosure or tampering, and potentially code execution.

Recommendations Update to version 5.8.7 or later.

Fix

Weakness Enumeration

CWE-250

Related Identifiers

BDU:2025-14414

CVE-2021-47700

Affected Products

Nagios Xi

References · 6

• https://nagios.com/changelog/nagios-xi · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-47700 · Security Note
• https://osv.dev/vulnerability/CVE-2021-47700 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14414 · Security Note
• https://twitter.com/CVEnew/status/1984015873586163879 · Twitter Post
• https://vulncheck.com/advisories/nagios-xi-insecure-permissions-on-highcharts-temporary-directory · Note