CVE-2021-37223

Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php

published October 5, 2021

CVSS
—
EPSS
5%
Percentile
92.2
In the wild
Unconfirmed
What it is

Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI application. Due to lack of input sanitisation, the target page can be replaced with an SSRF payload to access internal resources or disclose local system files.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04978 · 92.2th percentile
Published
2021-10-05T11:59Z
EPSS history
Timeline
  • 05 OCT 11:59Z
    Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php
    cvelistv5