CVE-2023-40933

—

CVSS 3.1

8.8 high

EPSS

3%p87

Published

Sep 19, 2023 (Sep 19, 2023)

Modified

Jul 9, 2026

Description

A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the update_banner_message() function.

Vendors: nagios
Products: nagios xi
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.1%)

In the news2 stories

Experts found flaws in Nagios XI network monitoring software

Security AffairsSep 20, 19:38 UTC · Sep 20, 2023Vulnerability CVE-2023-40931 CVE-2023-40932 CVE-2023-40933+1 CVEs

Critical Security Flaws Exposed in Nagios XI Network Monitoring Software

The Hacker NewsSep 20, 12:38 UTC · Sep 20, 2023Vulnerability CVE-2023-40931 CVE-2023-40934 CVE-2023-40933+1 CVEs