CVE-2018-8733
43Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 28%
from disclosure to weapon12 days
Published on NVDApr 18
1st PoC+12d
metasploitMar 6
exploitation probability
28%top 2% of all CVEs
observed exploitation
nono source reports it
4 public exploit(s)
Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to make configuration changes and leverage an authenticated SQL injection vulnerability.
Affected products
n/a · n/apublic PoCs found — 4✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/44969exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/44560cve_referencewww.exploit-db.com/exploits/44560/unverifiedcve_referencewww.exploit-db.com/exploits/44969/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXThttps://blog.redactedsec.net/exploits/2018/04/26/nagios.htmlhttps://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0fhttps://www.exploit-db.com/exploits/44560/https://www.exploit-db.com/exploits/44969/https://www.nagios.com/downloads/nagios-xi/change-log/