CVE-2011-10035: nagios xi through 2009 (inclusive), 2011 · update r1, 2011 · update r1.1 (+7 more affected versions); +1 more affected…

Affected technology

nagios xi · through 2009 (inclusive)
nagios

nagios xi · 2011 · update r1
nagios

nagios xi · 2011 · update r1.1
nagios

nagios xi · 2011 · update r1.2
nagios

nagios xi · 2011 · update r1.3
nagios

nagios xi · 2011 · update r1.4
nagios

nagios xi · 2011 · update r1.5
nagios

nagios xi · 2011 · update r1.6
nagios

nagios xi · 2011 · update r1.7
nagios

nagios xi · 2011 · update r1.8
nagios

XI · 0 to before 2011R1.9
Nagios

Description’s affected range: versions prior to 2011R1.9

Component: Installer / maintenance scripts

Attack conditions (Vendor/CNA, CVSS 4.0): Local · Low privileges required · No user interaction required

What an attacker can do

A local low-privileged user could manipulate filesystem state during crontab installation to influence the files or commands executed with elevated privileges, resulting in execution with higher privileges. Vendor/CNA’s CVSS 4.0 assessment (base score 7.3/10) rates confidentiality, integrity and availability impact as high.