Vulnerability Description
Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been mistakenly associated with CVE-2020-1408.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nagios | Nagios | 4.4.5 |
| Fedoraproject | Fedora | 32 |
Related Weaknesses (CWE)
References
- https://anhtai.me/nagios-core-4-4-5-url-injection/ExploitThird Party Advisory
- https://github.com/sawolf/nagioscore/tree/url-injection-fixProductThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://www.nagios.org/projects/nagios-core/history/4x/Release NotesVendor Advisory
- https://anhtai.me/nagios-core-4-4-5-url-injection/ExploitThird Party Advisory
- https://github.com/sawolf/nagioscore/tree/url-injection-fixProductThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://www.nagios.org/projects/nagios-core/history/4x/Release NotesVendor Advisory
FAQ
What is CVE-2020-13977?
CVE-2020-13977 is a vulnerability with a CVSS score of 4.9 (MEDIUM). Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of th...
How severe is CVE-2020-13977?
CVE-2020-13977 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-13977?
Check the references section above for vendor advisories and patch information. Affected products include: Nagios Nagios, Fedoraproject Fedora.