CVE-2021-37223
Last modified
CVE-2021-37223 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI application. EPSS estimates a 7.51% chance of exploitation in the next 30 days.
Description
Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI application. Due to lack of input sanitisation, the target page can be replaced with an SSRF payload to access internal resources or disclose local system files.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nagios | Nagios Xi | <= 5.8.4 |
References
- https://www.nagios.com/downloads/nagios-xi/change-log/Release Notes, Vendor Advisory
- https://www.nagios.com/downloads/nagios-xi/change-log/Release Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-37223?
How severe is CVE-2021-37223?
How do I fix CVE-2021-37223?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-37218HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows n…8.8
- CVE-2021-37219HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer…8.8
- CVE-2021-3722A denial of service vulnerability was reported in Lenovo PCM…5
- CVE-2021-37220MuPDF through 1.18.1 has an out-of-bounds write because the …5.5
- CVE-2021-37221A file upload vulnerability exists in Sourcecodester Custome…8.8
- CVE-2021-37222Parsers in the open source project RCDCAP before 1.0.5 allow…9.8
- CVE-2021-3723A command injection vulnerability was reported in the Integr…8.8
- CVE-2021-37231A stack-buffer-overflow occurs in Atomicparsley 20210124.204…5.5
- CVE-2021-37232A stack overflow vulnerability occurs in Atomicparsley 20210…9.8
- CVE-2021-37234Incorrect Access Control vulnerability in Modern Honey Netwo…6.5
- CVE-2021-3724Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2021-3725Vulnerability in dirhistory plugin Description: the widgets …8.8
Are you affected by CVE-2021-37223?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST