CVE-2018-15708: nagios nagios_xi

EPSS trend

Probability

89.36%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+5.99 pp

From 83.38% on 21-09-2026

21-09-202621-10-2026

EPSS score

89.36%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

4 found

referenceUnverified
Exploit Reference (tenable.com)
Maturity: unknown
MetasploitremoteVerified
Nagios XI Magpie_debug.php Root Remote Code Execution
exploit/linux/http/nagios_xi_magpie_debug
Maturity: weaponized
exploit-databaseremotelinuxVerified
Nagios XI 5.5.6 - Magpie_debug.php Root Remote Code Execution (Metasploit)
Maturity: weaponized

Show all 4 exploits

exploit-databaselinuxUnverified
Nagios XI 5.5.6 - Remote Code Execution / Privilege Escalation
Maturity: poc

References

3 links

www.exploit-db.com/exploits/46221/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.tenable.com/security/research/tra-2018-37X Refsource MISCExploitThird Party Advisory
packetstormsecurity.com/files/153433/Nagios-XI-Magpie_debug.php-Root-Remote-Code-Execution.htmlX Refsource MISC

Related vulnerabilities

CVE-2018-20171nagiosnagios_xi1.59%7y ago17-12-2018 15:00An issue was discovered in Nagios XI before 5.5.8. The url parameter of rss_dashlet/magpierss/scripts/magpie_simple.php is not filtered, resulting in an XSS vulnerability.CVE-2018-20172nagiosnagios_xi1.59%7y ago17-12-2018 15:00An issue was discovered in Nagios XI before 5.5.8. The rss_url parameter of rss_dashlet/magpierss/scripts/magpie_slashbox.php is not filtered, resulting in an XSS vulnerability.CVE-2018-17147nagiosnagios_xi2.70%7y ago10-07-2019 13:59Nagios XI before 5.5.4 has XSS in the auto login admin management page.CVE-2018-17146nagiosnagios_xi3.54%7y ago19-06-2019 17:25A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the auto login admin management page.CVE-2018-17148nagiosnagios_xi3.68%7y ago19-06-2019 17:23An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote attackers to gain access to configuration files containing confidential credentials.CVE-2018-10553nagiosnagios_xi38.37%8y ago30-04-2018 03:00An issue was discovered in Nagios XI 5.4.13. A registered user is able to use directory traversal to read local files, as demonstrated by URIs beginning with index.php?xiwindow=./ and config/?xiwindow=../ substrings.

All vulnerabilities innagios_xi

CVE-2018-15708: nagios nagios_xi

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References