CVE-2023-40931 — MEDIUM (6.5)

Q: How severe is CVE-2023-40931?

CVE-2023-40931 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2023-40931?

Check the references section above for vendor advisories and patch information. Affected products include: Nagios Nagios Xi.

Vulnerability Description

A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Nagios	Nagios Xi	>= 5.11.0, < 5.11.2

Related Weaknesses (CWE)

CWE-89

References

http://nagios.comProduct
https://outpost24.com/blog/nagios-xi-vulnerabilities/Third Party Advisory
https://www.nagios.com/products/security/Vendor Advisory
http://nagios.comProduct
https://outpost24.com/blog/nagios-xi-vulnerabilities/Third Party Advisory
https://www.nagios.com/products/security/Vendor Advisory

FAQ

What is CVE-2023-40931?

CVE-2023-40931 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /...

How severe is CVE-2023-40931?

CVE-2023-40931 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-40931?

Check the references section above for vendor advisories and patch information. Affected products include: Nagios Nagios Xi.