CVE-2009-2288: nagios OS Command Injection

CVSS: 7.5v2.0HighModified

AliasesRHSA-2009:1141DSA-1825-1

Published 01-07-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-2288 is a high (CVSS 7.5) OS Command Injection vulnerability in nagios. EPSS estimates a 83.45% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 5 public exploits are recorded.

Overall risk

57/100

0100

High · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

83.45%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits5reference, exploit-database, metasploit

Timeline

01-07-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

83.45%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 83.45% on 19-09-2026

19-09-202619-10-2026

EPSS score

83.45%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

5 found

referenceUnverified
Exploit Reference (tracker.nagios.org)
Maturity: unknown
exploit-databaseremotecgiVerified
Nagios 3.0.6 - 'statuswml.cgi' Arbitrary Shell Command Injection
Maturity: weaponized
exploit-databasecgiVerified
Nagios3 - 'statuswml.cgi' 'Ping' Command Execution (Metasploit)
Maturity: poc

Show all 5 exploits

exploit-databaseunixVerified
Nagios3 - 'statuswml.cgi' Command Injection (Metasploit)
Maturity: poc
MetasploitremoteVerified
Nagios3 statuswml.cgi Ping Command Execution
exploit/unix/webapp/nagios3_statuswml_ping
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Affected systems

Redhat3 products

nagios< 0:2.12-3.el5
nagios-debuginfo< 0:2.12-3.el5
nagios-devel< 0:2.12-3.el5

Debian2 products

nagios2< 2.6-2+etch3
nagios3< 3.0.6-4~lenny2

Nagios1 product

nagios≤ 3.1.0 | 1.0 | 1.0b1 | 1.0b2 | 1.0b4 | 1.1 | 1.4.1 | 2.0 | 2.0b4 | 2.7 | 2.10 | 3.0 | 3.0:alpha1 | 3.0:alpha2 | 3.0:alpha3 | 3.0:alpha4 | 3.0:beta1 | 3.0:beta2 | 3.0:beta3 | 3.0:beta4 | 3.0:beta5 | 3.0:beta6 | 3.0:beta7 | 3.0:rc1 | 3.0:rc2 | 3.0:rc3 | 3.0.1 | 3.0.2 | 3.0.3 | 3.0.4 | 3.0.5 | 3.0.6

3 vendors · 6 products