CVE-2020-36857

30.10.2025, 22:15

Nagios XI versions prior to 5.6.14 containa post-authentication SQL injection vulnerability in the SNMP Trap Interface page.Exploitation requires an account with administrative privileges to access the affected interface. A user with administrative access could supply crafted input that is not properly sanitized, allowing SQL injection that may lead to unauthorized disclosure or modification of application data or execution of arbitrary SQL commands against the backend database.

SQL Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	UNKNOWN				---
VulnCheck	CNA	---				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Common Weakness Enumeration

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

References

https://www.nagios.com/changelog/nagios-xi/

https://www.nagios.com/products/security/#nagios-xi

https://www.vulncheck.com/advisories/nagios-xi-authenticated-sqli-via-snmp-trap-interface-page