CVEvulnerability
CVE-2020-28907
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-05-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-295
Description
Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an untrusted update package in upgrade_to_latest.sh.
Affected configurations
• nagios fusion (<= 4.1.8)
Related
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html Third Party Advisory, VDB Entry
- https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ Exploit, Third Party Advisory
- https://www.nagios.com/downloads/nagios-xi/change-log/ Release Notes, Vendor Advisory
- http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html Third Party Advisory, VDB Entry
- https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ Exploit, Third Party Advisory
- https://www.nagios.com/downloads/nagios-xi/change-log/ Release Notes, Vendor Advisory