CVE-2018-8733 Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to make configuration changes and leverage an authentic...
CriticalCVSS 9.8
EPSS 26.6%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to make configuration changes and leverage an authenticated SQL injection vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nagios xi | >= 5.2.0, < 5.4.13 | 5.4.13 |
References
- assets.nagios.com release-notes vendor-advisory
- blog.redactedsec.net exploit technical-description third-party-advisory
- gist.github.com third-party-advisory
- 44560 exploit third-party-advisory vdb-entry
- 44969 exploit third-party-advisory vdb-entry
- www.nagios.com release-notes vendor-advisory