CVE-2021-40345

An issue was discovered in Nagios XI 5.8.5. In the Manage Dashlets section of the Admin panel, an administrator can upload ZIP files. A command injection (within the name of the first file in the archive) allows an attacker to execute system commands.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 98%
VendorProductVersion
nagiosnagios_xi
5.8.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT
https://github.com/ArianeBlow/NagiosXI-EmersonFI/blob/main/README.md
https://synacktiv.com
https://www.synacktiv.com/sites/default/files/2021-10/Nagios_XI_multiple_vulnerabilities_0.pdf
https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT
https://github.com/ArianeBlow/NagiosXI-EmersonFI/blob/main/README.md
https://synacktiv.com
https://www.synacktiv.com/sites/default/files/2021-10/Nagios_XI_multiple_vulnerabilities_0.pdf