Test ID:	1.3.6.1.4.1.25623.1.0.807835
Category:	Web application abuses
Title:	Nagios XI Multiple Vulnerabilities (Jun 2016)
Summary:	Nagios XI is prone to multiple vulnerabilities.;; This VT has been deprecated and replaced by the VT with the OID: 1.3.6.1.4.1.25623.1.0.105749.
Description:	Summary: Nagios XI is prone to multiple vulnerabilities. This VT has been deprecated and replaced by the VT with the OID: 1.3.6.1.4.1.25623.1.0.105749. Vulnerability Insight: Multiple errors are due to: - Insufficient sanitization of input passed via 'host' and 'service' GET parameters in the 'nagiosim.php' page. - Unescaped user input being passed to shell functions as an argument. - An insecure implementation of the application's component upload functionality. - An insecure implementation of the password reset functionality. - Multiple server-side request forgery vulnerabilities. Vulnerability Impact: Successful exploitation will allow remote attackers to conduct command injection, gain elevated privileges, conduct server side request forgery attacks, conduct account hijacking and inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data. Affected Software/OS: Nagios XI version 5.2.7 and prior. Solution: Update to Nagios XI version 5.2.8. CVSS Score: 6.5 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.