CVE-2020-6581

HIGH

Nagios NRPE 3.2.1 - OS Command Injection via Insufficient Filtering

Title source: llm

Description

Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline sequence). This can cause command injection.

References (3)

Core 3

Core References

Third Party Advisory x_refsource_misc

https://herolab.usd.de/security-advisories/

Exploit, Third Party Advisory x_refsource_misc

https://herolab.usd.de/security-advisories/usd-2020-0002/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DNGKXVDB43E3KQRA6W5QZT3Z46XZLQM/

Scores

CVSS v3 7.3

EPSS 0.0024

EPSS Percentile 47.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Details

Status published

Products (2)

fedoraproject/fedora 32

nagios/remote_plug_in_executor 3.2.1

Published Mar 16, 2020

Tracked Since Feb 18, 2026