CVE-2026-48551

Katalog CVE

CVSS 7.4 · High EPSS 0,26%

Kerentanan Cross-Site Request Forgery (CSRF). Skor CVSS 3.1 7.4 (High) menurut vulncheck.com.

Deskripsi (NVD)

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run commands as authorized users via malicious links.

Rincian

Terbit di NVD

12 Agustus 2026

Terakhir diubah

8 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

7.4 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog
• https://www.nagios.com/security-disclosures/nagios-core/
• https://www.vulncheck.com/advisories/nagios-core-xi-csrf-protection-bypass-via-double-submit-cookie