CVE-2019-20197

In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

22.40% chance of exploitation in the next 30 days, 98th percentile

Published

2019-12-31

Updated

2024-08-05

Proof-of-concept exploits (3)

• https://code610.blogspot.com/2019/12/postauth-rce-in-latest-nagiosxi.html
• jas502n/CVE-2019-2019723★ · 2020-01-08
• lp008/CVE-2019-201971★ · 2020-01-08

References

• CVE Record
• NVD entry

Related

• CVE-2019-0708
• CVE-2019-10758
• CVE-2020-13942
• CVE-2021-25646
• CVE-2019-20183
• CVE-2019-20198