PT-2025-44532 · Nagios Enterprises · Nagios Xi

Published 2012-12-05 · Updated 2025-11-06 · CVE-2012-10063

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2012R1.3

Description Nagios XI is affected by a SQL injection issue in the legacy Core Configuration Manager (CCM) interface. Authenticated users can manipulate SQL queries by providing crafted input to specific CCM parameters. This could allow access to configuration data stored in the application database. Successful exploitation may lead to disclosure or modification of notification data and potentially impact the application database. The vulnerable parameters are not specified.

Recommendations Update Nagios XI to version 2012R1.3 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-14475

CVE-2012-10063

Affected Products

Nagios Xi

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2012-10063 · Security Note
• https://bdu.fstec.ru/vul/2025-14475 · Security Note
• https://tenable.com/cve/CVE-2012-10063 · Note
• https://vulncheck.com/advisories/nagios-xi-authenticated-sqli-in-legacy-ccm · Note
• https://t.me/cveNotify/141923 · Telegram Post
• https://nagios.com/changelog/nagios-xi · Note