Unscored severity · published Jul 1, 2009
CVE-2009-2288
statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters
–
CVSS
83.5%
EPSS
No
On KEV
Description
statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.
Exploitation
Is it being used?
Exploit prediction (EPSS)83.5% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
Nagios · Nagios
through 3.1.0; 1.0; 1.0b1; 1.0b2; 1.0b4; 1.1; +26 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2288
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2288
marc.info
http://marc.info/?l=bugtraq&m=126996888626964&w=2
Vendor Advisory
http://secunia.com/advisories/35543
secunia.com
http://secunia.com/advisories/35688
secunia.com
http://secunia.com/advisories/35692
secunia.com
http://secunia.com/advisories/39227
security.gentoo.org
http://security.gentoo.org/glsa/glsa-200907-15.xml
More from Nagios
9.8
CVE-2016-0726
The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for remote attackers to obtain access by…
9.8
CVE-2014-5009
Snoopy allows remote attackers to execute arbitrary commands
9.8
CVE-2008-7313
The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands
9.8
CVE-2016-9565
MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the…
8.8
CVE-2020-6585
Nagios Log Server 2.1.3 has CSRF