CVE-2012-10063
Last modified
CVE-2012-10063 is a high-severity vulnerability rated 8.7/10 on the CVSS scale. Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowing access to configuration data stored in the application database. Successful exploitation could disclose or modify notification data and, in some cases, impact the application database more broadly.. EPSS estimates a 0.93% chance of exploitation in the next 30 days.
Description
Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowing access to configuration data stored in the application database. Successful exploitation could disclose or modify notification data and, in some cases, impact the application database more broadly.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Nagios | Nagios Xi | <= 2011 | — |
| Nagios | Nagios Xi | 2012 | R1.0 |
References
- https://www.nagios.com/changelog/nagios-xi/Release Notes
- https://www.vulncheck.com/advisories/nagios-xi-authenticated-sqli-in-legacy-ccmThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2012-10063?
How severe is CVE-2012-10063?
How do I fix CVE-2012-10063?
Are you affected by CVE-2012-10063?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST