Vulnerability Description
Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection.
CVSS Score
8.8
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nagios | Nagios Xi | >= 5.2.0, < 5.4.13 |
Related Weaknesses (CWE)
References
- https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXTRelease NotesVendor Advisory
- https://blog.redactedsec.net/exploits/2018/04/26/nagios.htmlExploitTechnical DescriptionThird Party Advisory
- https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0fThird Party Advisory
- https://www.exploit-db.com/exploits/44560/ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/44969/ExploitThird Party AdvisoryVDB Entry
- https://www.nagios.com/downloads/nagios-xi/change-log/Release NotesVendor Advisory
- https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXTRelease NotesVendor Advisory
- https://blog.redactedsec.net/exploits/2018/04/26/nagios.htmlExploitTechnical DescriptionThird Party Advisory
- https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0fThird Party Advisory
- https://www.exploit-db.com/exploits/44560/ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/44969/ExploitThird Party AdvisoryVDB Entry
- https://www.nagios.com/downloads/nagios-xi/change-log/Release NotesVendor Advisory
FAQ
What is CVE-2018-8735?
CVE-2018-8735 is a vulnerability with a CVSS score of 8.8 (HIGH). Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection.
How severe is CVE-2018-8735?
CVE-2018-8735 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-8735?
Check the references section above for vendor advisories and patch information. Affected products include: Nagios Nagios Xi.