Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE
Vulnerability Description
Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file paths and extensions during MIB upload and snapshot rename operations. Exploitation results in the placement of attacker-controlled PHP files in a web-accessible directory, executed as the www-data user.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-13986
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- M. Cory Billington of theyhack.me
References
More from Nagios
View All →Affected Vendor
Nagios
View all reports →