CVE-2023-40934
HighCVSS 7.2Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings.
Risk Assessment
An attacker can read, modify, or delete database data, potentially compromising the confidentiality, integrity, and availability of the monitoring system.
Recommendation
Immediately update Nagios XI to version 5.11.2 or later, which includes a fix for the SQL injection vulnerability.
Other vulnerabilities in Nagios XI
See all- CVE-2023-40931Medium
A SQL injection vulnerability in Nagios XI versions 5.11.0 through 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in a POST request to /nagiosxi/admin/banner_message-ajaxhelper.php.
- CVE-2021-25299Medium
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS) in /usr/local/nagiosxi/html/admin/sshterm.php due to improper input sanitization. A crafted URL can steal admin session cookies or be chained with other bugs for one-click RCE.
- CVE-2021-25298HighActively exploited
Nagios XI version xi-5.7.5 is affected by OS command injection due to improper sanitization of authenticated user input in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php.
- CVE-2021-25297HighActively exploited
A vulnerability in Nagios XI version xi-5.7.5 allows OS command injection. The issue exists in the switch.inc.php file due to improper sanitization of authenticated user input.
- CVE-2021-25296HighActively exploited
Nagios XI version xi-5.7.5 is affected by OS command injection in the file windowswmi.inc.php due to improper sanitization of authenticated user input. This allows execution of arbitrary commands on the server.
- CVE-2025-56432Medium
A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScript in the context of a logged-in user's session via a specially crafted URL. The issue resides in a web component responsible for rendering performance-related data.
- CVE-2024-33775High
An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted Dashlet.
- CVE-2023-40933High
A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the update_banner_message() function.
- CVE-2023-40932Medium
A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary JavaScript or HTML via the alt-text field. This affects all pages containing the navbar including the login page, enabling the attacker to steal plaintext credentials.
- CVE-2021-37345High
A vulnerability in Nagios XI before version 5.8.5 allows local privilege escalation. This is due to the xi-sys.cfg file being imported from the var directory by scripts running with elevated privileges.
Original NVD description (English source)
A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings.