CVE-2023-40931

medium · 6.5

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php

6.5

CVSS

11.3%

EPSS (exploit prob.)

96th

EPSS percentile

2023-09-19

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
nagios	nagios_xi	>= 5.11.0, < 5.11.2

Check a specific version with /api/v1/cve/match.

References

https://outpost24.com/blog/nagios-xi-vulnerabilities/
https://www.nagios.com/products/security/
https://outpost24.com/blog/nagios-xi-vulnerabilities/
https://www.nagios.com/products/security/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-40931