Lucene search

SNPSCVELIST:CVE-2021-33177

HistoryOct 14, 2021 - 2:55 p.m.

CVE-2021-33177

2021-10-1414:55:39

CWE-89

SNPS

www.cve.org

nagios xi

bulk modifications

sql injection

authentication

arbitrary queries

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

46.9%

JSON

The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authenticated to the vulnerable system, but once authenticated they would be able to execute arbitrary sql queries.

CNA Affected

[
  {
    "product": "Nagios XI",
    "vendor": "Nagios",
    "versions": [
      {
        "status": "affected",
        "version": "<5.8.5"
      }
    ]
  }
]

References

www.synopsys.com/blogs/software-security/cyrc-advisory-nagios-xi