CVE-2021-37223

MediumCVSS 6.5

Published: 05/10/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

4.78%

91th percentile - higher than 91% of all known CVEs

Summary

An SSRF vulnerability in NagiosXI up to version 5.8.4 allows authenticated users to create scheduled reports with PDF screenshots of any view. Lack of input sanitization enables replacing the target page with an SSRF payload.

Risk Assessment

An attacker can access internal network resources or read local system files, leading to sensitive data leakage and potential attack escalation.

Recommendation

Immediately update NagiosXI to version 5.8.5 or later, which includes a fix for the SSRF vulnerability.

Original NVD description (English source)

Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI application. Due to lack of input sanitisation, the target page can be replaced with an SSRF payload to access internal resources or disclose local system files.