CVE-2018-17148

CRITICAL

Nagios XI < 5.5.4 - Insufficient Access Control in Configuration Snapshot Page

Title source: llm
STIX 2.1

Description

An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote attackers to gain access to configuration files containing confidential credentials.

References (1)

Core 1
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT

Scores

CVSS v3 9.8
EPSS 0.0019
EPSS Percentile 41.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-284
Status published
Products (1)
nagios/nagios_xi < 5.5.4
Published Jun 19, 2019
Tracked Since Feb 18, 2026