CVE-2024-14004
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Summary
Nagios XI versions prior to 2024R1.2 contain a privilege escalation vulnerability related to NagVis configuration handling (nagvis.conf). An authenticated user could manipulate NagVis configuration data or leverage insufficiently validated configuration settings to obtain elevated privileges on the Nagios XI system.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Nagios | XI | 0 < 2024R1.2 | unknown |
Weaknesses
- CWE-269: CWE-269 Improper Privilege Management
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
- https://www.nagios.com/products/security/#nagios-xi
- https://www.nagios.com/changelog/nagios-xi/
- https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-nagvis-configuration
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.