Paper/Archive/CVE-2012-10063

CVE-2012-10063

Nagios XI — Nagios XI < 2012R1.3 Authenticated SQL Injection in Legacy CCM

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 66.1.661 × 2013.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowing access to configuration data stored in the application database. Successful exploitation could disclose or modify notification data and, in some cases, impact the application database more broadly.

Affected

ProductAffectedFixed inSource

XI< 2012R1.32012R1.3CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulnCheck (CNA)8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

patchnagios.com/changelog/nagios-xi writeupvulncheck.com/advisories/nagios-xi-authenticated-sqli-in-legacy-ccm