CVE-2023-40931

MediumCVSS 6.5

Published: 19/09/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

11.28%

95th percentile - higher than 95% of all known CVEs

Summary

A SQL injection vulnerability in Nagios XI versions 5.11.0 through 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in a POST request to /nagiosxi/admin/banner_message-ajaxhelper.php.

Risk Assessment

An attacker can gain unauthorized access to the database, steal or modify sensitive monitoring data, potentially compromising system integrity and confidentiality.

Recommendation

Immediately upgrade Nagios XI to version 5.11.2 or later, which includes a fix for the SQL injection vulnerability.

Original NVD description (English source)

A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php