Unscored severity · published Nov 10, 2008
CVE-2008-5028
Cross-site request forgery (CSRF) vulnerability in cmd.cgi in (1) Nagios 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote attackers to send commands to the Nagios process, and…
–
CVSS
2.2%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in cmd.cgi in (1) Nagios 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote attackers to send commands to the Nagios process, and trigger execution of arbitrary programs by this process, via unspecified HTTP requests.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Monitor · Op5
through 4.0.0; 2.4; 2.6; 2.8; 3.0; 3.0.0; +5 more · source: NVD
NA
Nagios · Nagios
through 3.0.4; 1.0; 1.0_b1; 1.0_b2; 1.0_b3; 1.0b1; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-5028
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-5028
git.op5.org
http://git.op5.org/git/?p=nagios.git%3Ba=commit%3Bh=814d8d4d1a73f7151eeed187c0667585d79fea18
marc.info
http://marc.info/?l=bugtraq&m=124156641928637&w=2
osvdb.org
http://osvdb.org/49678
Vendor Advisory
http://secunia.com/advisories/32610
secunia.com
http://secunia.com/advisories/32630
secunia.com
http://secunia.com/advisories/33320
More from Nagios
9.8
CVE-2016-0726
The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for remote attackers to obtain access by…
9.8
CVE-2014-5009
Snoopy allows remote attackers to execute arbitrary commands
9.8
CVE-2008-7313
The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands
9.8
CVE-2016-9565
MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the…
8.8
CVE-2020-6585
Nagios Log Server 2.1.3 has CSRF