CVE-2020-36869CWE-89sql-injection

CVE-2020-36869

High · published October 31, 2025

CVSS v3.1
7.2
EPSS
2%
Percentile
80.2
In the wild
Unconfirmed
What it is

⚡ An unsuspecting administrator could easily unleash chaos with a few crafty inputs! This SQL injection vulnerability in Nagios XI's SNMP Trap Interface could let them manipulate your backend database like a magician pulling rabbits out of hats. 🎩✨ Think of the SNMP Trap Interface as a restaurant kitchen where the head chef can change the menu at will. If they don’t double-check the ingredient list before making changes, they could accidentally serve up something harmful instead of delicious! An attacker with administrative access could craft malicious inputs, allowing unauthorized access to sensitive application data or even execute arbitrary SQL commands. This could lead to data leaks or corrupting crucial application information, leaving your system in a precarious state.

Put simply

Think of the SNMP Trap Interface as a restaurant kitchen where the head chef can change the menu at will. If they don’t double-check the ingredient list before making changes, they could accidentally serve up something harmful instead of delicious! CVE-2020-36869 is a SQL injection vulnerability in Nagios XI versions prior to 5.7.5, stemming from insufficient input sanitization in the SNMP Trap Interface edit page that allows crafted SQL commands to be executed against the backend database.

What to do

An attacker with administrative access could craft malicious inputs, allowing unauthorized access to sensitive application data or even execute arbitrary SQL commands. This could lead to data leaks or corrupting crucial application information, leaving your system in a precarious state. To mitigate this threat, upgrade Nagios XI to version 5.7.5 or later immediately. Additionally, review and sanitize all user inputs in the SNMP Trap Interface to prevent similar vulnerabilities from creeping in. You’ve got this! Secure your system today, and you'll be one step closer to badge-wearing security hero status! 🛡️

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01967 · 80.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-10-31T02:15Z
Affected products (1)
ProductVersionsFixed in
nagios/nagios_xi< 5.7.55.7.5
References (2)
EPSS history
Timeline
  • 30 OCT 21:45Z
    Nagios XI < 5.7.5 SQL injection via SNMP Trap Interface Edit Page
    cvelistv5