Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2023-48085
CVE-2023-48085:
Nagios XI vulnerability analysis and mitigation
Overview
Nagios XI before version 5.11.3 contains a remote code execution (RCE) vulnerability via the component command_test.php. The vulnerability was discovered and disclosed in December 2023, affecting Nagios XI installations prior to version 5.11.3. The vulnerability has been assigned a CVE identifier CVE-2023-48085 and received a CVSS v3.1 base score of 9.8 (CRITICAL) (NVD).
Technical details
The vulnerability exists due to improper validation of user data used in a file path in the 'command_test.php' script. The severity assessment indicates a Critical rating with a CVSS v3.1 base score of 9.8, and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD, FortiGuard).
Impact
Successful exploitation of this vulnerability could result in arbitrary command execution under the security context of the user running the vulnerable server. This can lead to system compromise, allowing remote attackers to gain control of vulnerable systems (FortiGuard).
Mitigation and workarounds
The recommended action is to upgrade to Nagios XI version 5.11.3 or above. Users should apply the most recent upgrade or patch available from the vendor (FortiGuard).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management