CVE-2008-5028 Cross-site request forgery (CSRF) vulnerability in cmd.cgi in (1) Nagios 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote attackers to send commands to the Nagios process, and trigger execution of...
MediumCVSS 6.8
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site request forgery (CSRF) vulnerability in cmd.cgi in (1) Nagios 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote attackers to send commands to the Nagios process, and trigger execution of arbitrary programs by this process, via unspecified HTTP requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nagios | <= 3.0.4 | No fix listed |
| nagios | = 1.0 | No fix listed |
| nagios | = 1.0_b1 | No fix listed |
| nagios | = 1.0_b2 | No fix listed |
| nagios | = 1.0_b3 | No fix listed |
| nagios | = 1.0b1 | No fix listed |
| nagios | = 1.0b2 | No fix listed |
| nagios | = 1.0b3 | No fix listed |
| nagios | = 1.0b4 | No fix listed |
| nagios | = 1.0b5 | No fix listed |
| nagios | = 1.0b6 | No fix listed |
| nagios | = 1.1 | No fix listed |
| nagios | = 1.2 | No fix listed |
| nagios | = 1.3 | No fix listed |
| nagios | = 1.4 | No fix listed |
| nagios | = 1.4.1 | No fix listed |
| nagios | = 2.0 | No fix listed |
| nagios | = 2.0b1 | No fix listed |
| nagios | = 2.0b2 | No fix listed |
| nagios | = 2.0b3 | No fix listed |
| nagios | = 2.0b4 | No fix listed |
| nagios | = 2.0b5 | No fix listed |
| nagios | = 2.0b6 | No fix listed |
| nagios | = 2.0rc1 | No fix listed |
| nagios | = 2.0rc2 | No fix listed |
Show 40 more
| Product | Affected versions | Fixed in |
|---|---|---|
| nagios | = 2.1 | No fix listed |
| nagios | = 2.2 | No fix listed |
| nagios | = 2.3 | No fix listed |
| nagios | = 2.3.1 | No fix listed |
| nagios | = 2.4 | No fix listed |
| nagios | = 2.5 | No fix listed |
| nagios | = 2.7 | No fix listed |
| nagios | = 2.8 | No fix listed |
| nagios | = 2.9 | No fix listed |
| nagios | = 2.10 | No fix listed |
| nagios | = 2.11 | No fix listed |
| nagios | = 3.0 | No fix listed |
| nagios | = 3.0-alpha1 | No fix listed |
| nagios | = 3.0-alpha2 | No fix listed |
| nagios | = 3.0-alpha3 | No fix listed |
| nagios | = 3.0-alpha4 | No fix listed |
| nagios | = 3.0-beta1 | No fix listed |
| nagios | = 3.0-beta2 | No fix listed |
| nagios | = 3.0-beta3 | No fix listed |
| nagios | = 3.0-beta4 | No fix listed |
| nagios | = 3.0-beta5 | No fix listed |
| nagios | = 3.0-beta6 | No fix listed |
| nagios | = 3.0-beta7 | No fix listed |
| nagios | = 3.0-rc1 | No fix listed |
| nagios | = 3.0-rc2 | No fix listed |
| nagios | = 3.0-rc3 | No fix listed |
| nagios | = 3.0.1 | No fix listed |
| nagios | = 3.0.2 | No fix listed |
| nagios | = 3.0.3 | No fix listed |
| op5 monitor | <= 4.0.0 | No fix listed |
| op5 monitor | = 2.4 | No fix listed |
| op5 monitor | = 2.6 | No fix listed |
| op5 monitor | = 2.8 | No fix listed |
| op5 monitor | = 3.0 | No fix listed |
| op5 monitor | = 3.0.0 | No fix listed |
| op5 monitor | = 3.2 | No fix listed |
| op5 monitor | = 3.2.4 | No fix listed |
| op5 monitor | = 3.3.1 | No fix listed |
| op5 monitor | = 3.3.2 | No fix listed |
| op5 monitor | = 3.3.3 | No fix listed |
References
- git.op5.org
- SSRT090060 vendor-advisory
- 49678 vdb-entry
- 32610 third-party-advisory vendor-advisory
- 32630 third-party-advisory
- 33320 third-party-advisory
- 35002 third-party-advisory
- GLSA-200907-15 vendor-advisory
- [nagios-devel] 20081107 Security fixes completed mailing-list patch
- www.op5.com patch vendor-advisory
- [oss-security] 20081106 CVE request: Nagios (two issues) mailing-list
- 1022165 vdb-entry
- ADV-2008-3029 vdb-entry
- ADV-2009-1256 vdb-entry
- nagios-cmd-csrf(46426) vdb-entry
- op5monitor-unspecified-csrf(46521) vdb-entry
- USN-698-3 vendor-advisory