CVE-2021-37343

A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

23.82% chance of exploitation in the next 30 days, 98th percentile

Published

2021-08-13

Updated

2024-08-04

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/165978/Nagios-XI-Autodiscovery-Shell-Upload.html

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_autodiscove…

References

• CVE Record
• NVD entry

Related

• CVE-2021-3734
• CVE-2021-37354
• CVE-2021-37333
• CVE-2021-37358
• CVE-2021-37331
• CVE-2021-37363