CVE-2018-8735

Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection.

CVSS v3.0 NVD

8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

63.56% chance of exploitation in the next 30 days, 99th percentile

Published

2018-04-18

Updated

2024-08-05

Metasploit modules (2)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_chained_rce…
• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_chained_rce…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/44969
• https://www.exploit-db.com/exploits/44560

Security advisories

• https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT
• https://www.nagios.com/downloads/nagios-xi/change-log
• https://blog.redactedsec.net/exploits/2018/04/26/nagios.html
• https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f

References

• CVE Record
• NVD entry