CVE-2019-15949
Last modified
CVE-2019-15949 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. CISA has confirmed active exploitation in the wild. EPSS estimates a 77.74% chance of exploitation in the next 30 days.
Description
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nagios | Nagios Xi | < 5.6.6 |
References
- http://packetstormsecurity.com/files/156676/Nagios-XI-Authenticated-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/162158/Nagios-XI-getprofile.sh-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
- https://github.com/jakgibb/nagiosxi-root-rce-exploitExploit, Third Party Advisory
- http://packetstormsecurity.com/files/156676/Nagios-XI-Authenticated-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/162158/Nagios-XI-getprofile.sh-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
- https://github.com/jakgibb/nagiosxi-root-rce-exploitExploit, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-15949US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2019-15949?
How severe is CVE-2019-15949?
How do I fix CVE-2019-15949?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-15943vphysics.dll in Counter-Strike: Global Offensive before 1.37…8.8
- CVE-2019-15944In Counter-Strike: Global Offensive before 8/29/2019, commun…5.3
- CVE-2019-15945OpenSC before 0.20.0-rc1 has an out-of-bounds access of an A…6.4
- CVE-2019-15946OpenSC before 0.20.0-rc1 has an out-of-bounds access of an A…6.4
- CVE-2019-15947In Bitcoin Core 0.18.0, bitcoin-qt stores wallet.dat data un…7.5
- CVE-2019-15948Texas Instruments CC256x and WL18xx dual-mode Bluetooth cont…8.8
- CVE-2019-1595A vulnerability in the Fibre Channel over Ethernet (FCoE) pr…7.4
- CVE-2019-15950The CRM Plugin before 4.2.4 for Redmine allows XSS via craft…6.1
- CVE-2019-15952An issue was discovered in Total.js CMS 12.0.0. An authentic…
- CVE-2019-15953An issue was discovered in Total.js CMS 12.0.0. An authentic…
- CVE-2019-15954An issue was discovered in Total.js CMS 12.0.0. An authentic…9.9
- CVE-2019-15955An issue was discovered in Total.js CMS 12.0.0. A low privil…
Are you affected by CVE-2019-15949?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST