CVE-2020-28909: Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts

High severity · published May 24, 2021

CVE-2020-28909

Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts

8.8

CVSS

6.7%

EPSS

On KEV

Description

Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges users are able to modify files that can be executed by sudo.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)6.7% · higher than 94% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Fusion · Nagios

through 4.1.8 · source: NVD

Affected product

Fusion

Nagios

All Fusion CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-28909

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-28909

Third Party Advisory

http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html

Exploit

https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/

Release Notes

https://www.nagios.com/downloads/nagios-xi/change-log/