CVE-2018-15711

high · 8.8

Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key to execute API calls at elevated privileges.

8.8

CVSS

36.0%

EPSS (exploit prob.)

98th

EPSS percentile

2018-11-14

Published

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
nagios	nagios_xi	5.5.6

Check a specific version with /api/v1/cve/match.

References

https://www.tenable.com/security/research/tra-2018-37
https://www.tenable.com/security/research/tra-2018-37

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-15711