CVEvulnerability
CVE-2020-13977
4.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-06-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-829
Description
Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been mistakenly associated with CVE-2020-1408.
Affected configurations
• nagios nagios 4.4.5
• fedoraproject fedora 32
• fedoraproject fedora 33
• fedoraproject fedora 34
Related
Weakness · CWE (1)
- CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness
References
- https://anhtai.me/nagios-core-4-4-5-url-injection/ Exploit, Third Party Advisory
- https://github.com/sawolf/nagioscore/tree/url-injection-fix Product, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P6NHNG2SJAM6DXVTXQH3AOJ4WQVKJUE/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H7T6MSDWMBJEVVFSOK7DOYJJWDAFQCEQ/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUEIABR4Y6L5J5MZDFWU46ZWXMJO64U3/ lists.fedoraproject.org
- https://www.nagios.org/projects/nagios-core/history/4x/ Release Notes, Vendor Advisory
- https://anhtai.me/nagios-core-4-4-5-url-injection/ Exploit, Third Party Advisory
- https://github.com/sawolf/nagioscore/tree/url-injection-fix Product, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P6NHNG2SJAM6DXVTXQH3AOJ4WQVKJUE/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H7T6MSDWMBJEVVFSOK7DOYJJWDAFQCEQ/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUEIABR4Y6L5J5MZDFWU46ZWXMJO64U3/ lists.fedoraproject.org
- https://www.nagios.org/projects/nagios-core/history/4x/ Release Notes, Vendor Advisory