CVE-2024-13986

Katalog CVE

CVSS 8.8 · High EPSS 1,7%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada nagios xi. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file paths and extensions during MIB upload and snapshot rename operations. Exploitation results in the placement of attacker-controlled PHP files in a web-accessible directory, executed as the www-data user.

Rincian

Terbit di NVD

28 Agustus 2025

Terakhir diubah

26 September 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 77,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://theyhack.me/Nagios-XI-Authenticated-RCE exploit · advisory pihak ketiga
• https://theyhack.me/Nagios-XI-Authenticated-RCE/ exploit · advisory pihak ketiga
• https://www.nagios.com/changelog/nagios-xi/
• https://www.nagios.com/products/security/#nagios-xi
• https://www.vulncheck.com/advisories/nagios-xi-authenticated-arbitrary-file-upload-path-traversal-rce