CVEvulnerability
CVE-2020-28900
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-05-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-345
Description
Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to an untrusted update package to upgrade_to_latest.sh.
Affected configurations
• nagios fusion (<= 4.1.8)
• nagios nagios xi (<= 5.7.5)
Related
Weakness · CWE (1)
- CWE-345 Insufficient Verification of Data Authenticity weakness
References
- http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html Third Party Advisory, VDB Entry
- https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ Exploit, Third Party Advisory
- https://www.nagios.com/downloads/nagios-xi/change-log/ Release Notes, Vendor Advisory
- http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html Third Party Advisory, VDB Entry
- https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ Exploit, Third Party Advisory
- https://www.nagios.com/downloads/nagios-xi/change-log/ Release Notes, Vendor Advisory