PT-2026-82207 · Nagios · Nagios Core
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Nagios Core versions prior to 4.5.12
Description
A cross-site request forgery (CSRF) issue exists in the 'cmd.cgi' endpoint. The CSRF protection mechanism fails to properly validate requests when the
NagFormId cookie is missing. This allows an attacker to send a malicious cross-site POST request that executes arbitrary Nagios commands using the privileges of an authenticated user without their consent. CSRF is a type of attack that tricks a victim into submitting a malicious request.Recommendations
Update Nagios Core to version 4.5.12 or later.
Exploit
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nagios Core