CVE-2020-13977
CVE-2020-13977
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been mistakenly associated with CVE-2020-1408.
CVSS 4.9 · Medium · EPSS 2.7% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
nagios4 Debian:12
- Affected ranges
- ECOSYSTEM: < 4.3.4-4
Update to 4.3.4-4
nagios4 Debian:13
- Affected ranges
- ECOSYSTEM: < 4.3.4-4
Update to 4.3.4-4
nagios4 Debian:14
- Affected ranges
- ECOSYSTEM: < 4.3.4-4
Update to 4.3.4-4
nagios4 Ubuntu:20.04:LTS
- Versions
- 4.3.4-3
- 4.3.4-3ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://anhtai.me/nagios-core-4-4-5-url-injection/
- https://www.nagios.org/projects/nagios-core/history/4x/
- https://github.com/sawolf/nagioscore/tree/url-injection-fix
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H7T6MSDWMBJEVVFSOK7DOYJJWDAFQCEQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUEIABR4Y6L5J5MZDFWU46ZWXMJO64U3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P6NHNG2SJAM6DXVTXQH3AOJ4WQVKJUE/
- https://nvd.nist.gov/vuln/detail/CVE-2020-13977