CVE-2020-28900

Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to an untrusted update package to upgrade_to_latest.sh.

• CWE-345

• http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.htmlThird Party Advisory, VDB Entry
• https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/Exploit, Third Party Advisory
• https://www.nagios.com/downloads/nagios-xi/change-log/Release Notes, Vendor Advisory
• http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.htmlThird Party Advisory, VDB Entry
• https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/Exploit, Third Party Advisory
• https://www.nagios.com/downloads/nagios-xi/change-log/Release Notes, Vendor Advisory

Published

May 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-2889Vulnerability in the Oracle CRM Technical Foundation product…5.3
• CVE-2020-28895In Wind River VxWorks, memory allocator has a possible overf…7.3
• CVE-2020-28896Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensu…5.3
• CVE-2020-28898In QED ResourceXpress through 4.9k, a large numeric or alpha…5.3
• CVE-2020-28899The Web CGI Script on ZyXEL LTE4506-M606 V1.00(ABDO.2)C0 dev…9.1
• CVE-2020-2890Vulnerability in the Oracle Applications Framework product o…8.2
• CVE-2020-28901Command Injection in Nagios Fusion 4.1.8 and earlier allows …9.8
• CVE-2020-28902Command Injection in Nagios Fusion 4.1.8 and earlier allows …9.8
• CVE-2020-28903Improper input validation in Nagios Fusion 4.1.8 and earlier…6.1
• CVE-2020-28904Execution with Unnecessary Privileges in Nagios Fusion 4.1.8…9.8
• CVE-2020-28905Improper Input Validation in Nagios Fusion 4.1.8 and earlier…8.8
• CVE-2020-28906Incorrect File Permissions in Nagios XI 5.7.5 and earlier an…8.8