CVE-2021-40344: nagios nagios_xi
Vulnerability summary
CVE-2021-40344 is a high (CVSS 7.2) vulnerability in nagios nagios_xi. EPSS estimates a 64.80% chance of exploitation in the next 30 days, higher than 99.2% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 26-10-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. Therefore it is possible to upload a crafted PHP script to achieve remote command execution.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
64.80%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 64.80% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (synacktiv.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Nagios1 product
- nagios_xi5.8.5
1 vendor · 1 product
References
3 links- www.synacktiv.com/sites/default/files/2021-10/Nagios_XI_multiple_vulnerabilities_0.pdfX Refsource MISCExploitThird Party Advisory