CVE-2023-40931

—

CVSS 3.1

6.5 medium

EPSS

11%p96

Published

Sep 19, 2023 (Sep 19, 2023)

Modified

Jul 9, 2026

Description

A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php

Vendors: nagios
Products: nagios xi
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (11.3%)

In the news2 stories

Experts found flaws in Nagios XI network monitoring software

Security AffairsSep 20, 19:38 UTC · Sep 20, 2023Vulnerability CVE-2023-40931 CVE-2023-40932 CVE-2023-40933+1 CVEs

Critical Security Flaws Exposed in Nagios XI Network Monitoring Software

The Hacker NewsSep 20, 12:38 UTC · Sep 20, 2023Vulnerability CVE-2023-40931 CVE-2023-40934 CVE-2023-40933+1 CVEs