CVE-2013-10072: nagios xi through 2011 (inclusive), 2012 · update r1.0, 2012 · update r1.1 (+4 more affected versions); +1 more…

Affected technology

nagios xi · through 2011 (inclusive)
nagios

nagios xi · 2012 · update r1.0
nagios

nagios xi · 2012 · update r1.1
nagios

nagios xi · 2012 · update r1.2
nagios

nagios xi · 2012 · update r1.3
nagios

nagios xi · 2012 · update r1.4
nagios

nagios xi · 2012 · update r1.5
nagios

XI · 0 to before 2012R1.6
Nagios

Description’s affected range: versions prior to 2012R1.6

Component: Web UI / API – Auto-Discovery module

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Users with read-only roles could directly reach Auto-Discovery endpoints and pages that should require elevated permissions, exposing discovery results and allowing unintended access to discovery operations. Vendor/CNA’s CVSS 4.0 assessment (base score 7.2/10) rates confidentiality impact as high; integrity and availability impact as low.