vulnwire
8.8high

CVE-2016-15050

Nagios XI < 5.2.4 SQL Injection in Notification Search

Published 12 mo ago · modified 20 d ago · JSON

CVSS
8.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
1.1%
percentile 66%
Public exploits
0
none known

Nagios XI versions prior to 5.2.4 contain a SQL injection vulnerability in the notification search functionality. User-supplied search parameters were incorporated into SQL statements without adequate parameterization or sanitation, allowing an authenticated user to manipulate database queries. Successful exploitation could disclose or modify notification data and, in some cases, impact the application database more broadly.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
total
Assessed
12 mo ago

Exploit prediction (EPSS)

1.11% probability of exploitation in the next 30 days, higher than 66% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA4.08.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA4.08.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD3.18.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Nagios XI

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

  • nagios.com /changelog/nagios-xi/ · release-notes, patch
  • vulncheck.com /advisories/nagios-xi-sqli-in-notification-search · third-party-advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.