CVE-2023-40934

HIGH

Nagios XI < 5.11.2 - Authenticated SQL Injection via Host Escalation Notification Settings

Title source: llm

Description

A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings.

References (3)

Core 3

Core References

Product

http://nagios.com

Third Party Advisory

https://outpost24.com/blog/nagios-xi-vulnerabilities/

Vendor Advisory

https://www.nagios.com/products/security/

Scores

CVSS v3 7.2

EPSS 0.0122

EPSS Percentile 79.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-89

Status published

Products (1)

nagios/nagios_xi < 5.11.2

Published Sep 19, 2023

Tracked Since Feb 18, 2026