CVE-2020-28909 - Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts

Back Back to CVE browser

HIGH

Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts

Published May 24, 2021

8.8

HIGH

CVSS 3.1

EPSS 5.13%

Description

Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges users are able to modify files that can be executed by sudo.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-732

Incorrect Permission Assignment

References (4)

http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html
x_refsource_MISCThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-21300
Advisory
https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/
x_refsource_MISCExploitThird Party Advisory
https://www.nagios.com/downloads/nagios-xi/change-log/
x_refsource_MISCRelease NotesVendor Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html		x_refsource_MISCThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-21300		Advisory
https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/		x_refsource_MISCExploitThird Party Advisory
https://www.nagios.com/downloads/nagios-xi/change-log/		x_refsource_MISCRelease NotesVendor Advisory