CVE-2023-40934

—

CVSS 3.1

7.2 high

EPSS

3%p88

Published

Sep 19, 2023 (Sep 19, 2023)

Modified

Jul 9, 2026

Description

A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings.

Vendors: nagios
Products: nagios xi
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.2%)

In the news2 stories

Experts found flaws in Nagios XI network monitoring software

Security AffairsSep 20, 19:38 UTC · Sep 20, 2023Vulnerability CVE-2023-40931 CVE-2023-40932 CVE-2023-40933+1 CVEs

Critical Security Flaws Exposed in Nagios XI Network Monitoring Software

The Hacker NewsSep 20, 12:38 UTC · Sep 20, 2023Vulnerability CVE-2023-40931 CVE-2023-40934 CVE-2023-40933+1 CVEs