CVE-2020-13977

Katalog CVE

CVSS 4.9 · Medium EPSS 2,7%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere pada nagios, fedoraproject fedora. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been mistakenly associated with CVE-2020-1408.

Rincian

Terbit di NVD

9 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

2,7% peluang dieksploitasi; lebih tinggi dari 85,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.nagios.org/projects/nagios-core/history/4x/ release notes · advisory vendor
• https://anhtai.me/nagios-core-4-4-5-url-injection/ exploit · advisory pihak ketiga
• https://github.com/sawolf/nagioscore/tree/url-injection-fix product · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P6NHNG2SJAM6...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H7T6MSDWMBJEV...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUEIABR4Y6L5J...