CVE-2012-10063
Last modified
CVE-2012-10063 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowing access to configuration data stored in the application database. Successful exploitation could disclose or modify notification data and, in some cases, impact the application database more broadly.. EPSS estimates a 1.02% chance of exploitation in the next 30 days.
Description
Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowing access to configuration data stored in the application database. Successful exploitation could disclose or modify notification data and, in some cases, impact the application database more broadly.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Nagios | Nagios Xi | <= 2011 | — |
| Nagios | Nagios Xi | 2012 | R1.0 |
References
- https://www.nagios.com/changelog/nagios-xi/Release Notes
- https://www.vulncheck.com/advisories/nagios-xi-authenticated-sqli-in-legacy-ccmThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2012-10063?
How severe is CVE-2012-10063?
How do I fix CVE-2012-10063?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2012
- CVE-2012-10058RabidHamster R4 v1.25 contains a stack-based buffer overflow…10
- CVE-2012-10059Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a po…9.4
- CVE-2012-1006Multiple cross-site scripting (XSS) vulnerabilities in Apach…
- CVE-2012-10060Sysax Multi Server versions prior to 5.55 contain a stack-ba…9.8
- CVE-2012-10061Sockso Music Host Server versions <= 1.5 are vulnerable to a…8.7
- CVE-2012-10062A vulnerability in XAMPP, developed by Apache Friends, versi…8.7
- CVE-2012-10064Omni Secure Files plugin versions prior to 0.1.14 contain an…9.3
- CVE-2012-1007Multiple cross-site scripting (XSS) vulnerabilities in Apach…
- CVE-2012-1008OfficeSIP Server 3.1 allows remote attackers to cause a deni…
- CVE-2012-1009NetSarang Xlpd 4 Build 0100 and NetSarang Xmanager Enterpris…
- CVE-2012-1010Unrestricted file upload vulnerability in actions.php in the…
- CVE-2012-1011actions.php in the AllWebMenus plugin 1.1.8 for WordPress al…
Are you affected by CVE-2012-10063?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST