CVE-2024-14008

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.3.2

Description Nagios XI is affected by a remote command execution issue in the WinRM Configuration Wizard. A lack of proper input validation allows an authenticated administrator to inject shell metacharacters into backend command invocations. Successful exploitation can lead to arbitrary command execution with the privileges of the Nagios XI web application user. The vulnerable component is the WinRM Configuration Wizard. The issue involves insufficient validation of user-supplied input.

Recommendations Update Nagios XI to version 2024R1.3.2 or later.