CVE-2023-40934 - A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings

Back Back to CVE browser

HIGH

A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings

Published Sep 19, 2023

7.2

HIGH

CVSS 3.1

EPSS 2.40%

Description

A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-45473
Advisory
https://outpost24.com/blog/nagios-xi-vulnerabilities/
Third Party Advisory
https://www.nagios.com/products/security/
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-45473		Advisory
https://outpost24.com/blog/nagios-xi-vulnerabilities/		Third Party Advisory
https://www.nagios.com/products/security/		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Sep 19, 2023

Updated Jul 9, 2026

Reserved Aug 22, 2023

Link CVE-2023-40934

CISA Vulnrichment

Updated Sep 24, 2024

NVD

Status Modified

Modified Jul 9, 2026

Link CVE-2023-40934

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Sep 19, 2023

Updated Jul 9, 2026

Link EUVD-2023-45473

GitHub

No data