high8.8Public exploit code
CVE-2018-8736
A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Nagios XI 5.2.6-5.4.12 - Chained Remote Code Execution (Metasploit)2018-07-02 · remote · linux · Verified
- Nagios XI 5.2.6 < 5.2.9 / 5.3 / 5.4 - Chained Remote Root2018-04-30 · webapps · php · Verified
Impact
A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nagios | Nagios Xi | from 5.2.0 before 5.4.13 |
References
- NVD record
- CVE.org record
- https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT
- https://blog.redactedsec.net/exploits/2018/04/26/nagios.html
- https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f
- https://www.exploit-db.com/exploits/44560/
- https://www.exploit-db.com/exploits/44969/
- https://www.nagios.com/downloads/nagios-xi/change-log/
- https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT
- https://blog.redactedsec.net/exploits/2018/04/26/nagios.html
- https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f
- https://www.exploit-db.com/exploits/44560/
- https://www.exploit-db.com/exploits/44969/
- https://www.nagios.com/downloads/nagios-xi/change-log/