CVE-2008-5027 The Nagios process in (1) Nagios before 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote authenticated users to bypass authorization checks, and trigger execution of arbitrary programs by this pro...
MediumCVSS 6.5
EPSS 6.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Nagios process in (1) Nagios before 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote authenticated users to bypass authorization checks, and trigger execution of arbitrary programs by this process, via an (a) custom form or a (b) browser addon.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nagios | <= 3.0.4 | No fix listed |
| nagios | = 1.0 | No fix listed |
| nagios | = 1.0_b1 | No fix listed |
| nagios | = 1.0_b2 | No fix listed |
| nagios | = 1.0_b3 | No fix listed |
| nagios | = 1.0b1 | No fix listed |
| nagios | = 1.0b2 | No fix listed |
| nagios | = 1.0b3 | No fix listed |
| nagios | = 1.0b4 | No fix listed |
| nagios | = 1.0b5 | No fix listed |
| nagios | = 1.0b6 | No fix listed |
| nagios | = 1.1 | No fix listed |
| nagios | = 1.2 | No fix listed |
| nagios | = 1.3 | No fix listed |
| nagios | = 1.4 | No fix listed |
| nagios | = 1.4.1 | No fix listed |
| nagios | = 2.0 | No fix listed |
| nagios | = 2.0b1 | No fix listed |
| nagios | = 2.0b2 | No fix listed |
| nagios | = 2.0b3 | No fix listed |
| nagios | = 2.0b4 | No fix listed |
| nagios | = 2.0b5 | No fix listed |
| nagios | = 2.0b6 | No fix listed |
| nagios | = 2.0rc1 | No fix listed |
| nagios | = 2.0rc2 | No fix listed |
Show 40 more
| Product | Affected versions | Fixed in |
|---|---|---|
| nagios | = 2.1 | No fix listed |
| nagios | = 2.2 | No fix listed |
| nagios | = 2.3 | No fix listed |
| nagios | = 2.3.1 | No fix listed |
| nagios | = 2.4 | No fix listed |
| nagios | = 2.5 | No fix listed |
| nagios | = 2.7 | No fix listed |
| nagios | = 2.8 | No fix listed |
| nagios | = 2.9 | No fix listed |
| nagios | = 2.10 | No fix listed |
| nagios | = 2.11 | No fix listed |
| nagios | = 3.0 | No fix listed |
| nagios | = 3.0-alpha1 | No fix listed |
| nagios | = 3.0-alpha2 | No fix listed |
| nagios | = 3.0-alpha3 | No fix listed |
| nagios | = 3.0-alpha4 | No fix listed |
| nagios | = 3.0-beta1 | No fix listed |
| nagios | = 3.0-beta2 | No fix listed |
| nagios | = 3.0-beta3 | No fix listed |
| nagios | = 3.0-beta4 | No fix listed |
| nagios | = 3.0-beta5 | No fix listed |
| nagios | = 3.0-beta6 | No fix listed |
| nagios | = 3.0-beta7 | No fix listed |
| nagios | = 3.0-rc1 | No fix listed |
| nagios | = 3.0-rc2 | No fix listed |
| nagios | = 3.0-rc3 | No fix listed |
| nagios | = 3.0.1 | No fix listed |
| nagios | = 3.0.2 | No fix listed |
| nagios | = 3.0.3 | No fix listed |
| op5 monitor | <= 4.0.0 | No fix listed |
| op5 monitor | = 2.4 | No fix listed |
| op5 monitor | = 2.6 | No fix listed |
| op5 monitor | = 2.8 | No fix listed |
| op5 monitor | = 3.0 | No fix listed |
| op5 monitor | = 3.0.0 | No fix listed |
| op5 monitor | = 3.2 | No fix listed |
| op5 monitor | = 3.2.4 | No fix listed |
| op5 monitor | = 3.3.1 | No fix listed |
| op5 monitor | = 3.3.2 | No fix listed |
| op5 monitor | = 3.3.3 | No fix listed |
References
- SSRT090060 vendor-advisory
- 33320 third-party-advisory
- 35002 third-party-advisory
- GLSA-200907-15 vendor-advisory
- [nagios-devel] 20081107 Security fixes completed mailing-list patch vendor-advisory
- www.nagios.org patch
- www.op5.com vendor-advisory
- [oss-security] 20081106 CVE request: Nagios (two issues) mailing-list
- 32156 patch vdb-entry
- 1022165 vdb-entry
- USN-698-1 vendor-advisory
- ADV-2008-3029 vdb-entry
- ADV-2008-3364 vdb-entry
- ADV-2009-1256 vdb-entry
- USN-698-3 vendor-advisory