CVE-2013-10073: nagios xi before 2012 (exclusive), 2012 · update r1.0, 2012 · update r1.1 (+4 more affected versions); +1 more…

Affected technology

nagios xi · before 2012 (exclusive)
nagios

nagios xi · 2012 · update r1.0
nagios

nagios xi · 2012 · update r1.1
nagios

nagios xi · 2012 · update r1.2
nagios

nagios xi · 2012 · update r1.3
nagios

nagios xi · 2012 · update r1.4
nagios

nagios xi · 2012 · update r1.5
nagios

XI · 0 to before 2012R1.6
Nagios

Description’s affected range: versions prior to 2012R1.6

Component: Auto-Discovery tool – shell invocation / wrapper scripts

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated user with access to discovery functionality can execute arbitrary commands with the privileges of the application service. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.