CVE-2023-38349
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
PNP4Nagios through 81ebfc5 lacks CSRF protection in the AJAX controller. This affects version 0.6.26.
Risk Assessment
The lack of CSRF protection may allow attackers to perform unauthorized actions on behalf of a logged-in user, potentially leading to serious security breaches.
Recommendation
It is recommended to update PNP4Nagios to the latest version that implements proper CSRF protection.
Other vulnerabilities in PNP4Nagios
See all- CVE-2017-16834High
PNP4Nagios through 0.6.26 has /usr/bin/npcd and npcd.cfg owned by an unprivileged account. Exploiting these files can lead to root code execution by local users.
- CVE-2023-38350Medium
PNP4Nagios version 0.6.26 has a stored XSS vulnerability in the AJAX controller via the basket API and filters.
Original NVD description (English source)
PNP4Nagios through 81ebfc5 lacks CSRF protection in the AJAX controller. This affects 0.6.26.