Description
The Nagios process in (1) Nagios before 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote authenticated users to bypass authorization checks, and trigger execution of arbitrary programs by this process, via an (a) custom form or a (b) browser addon.
References
- [nagios-devel] 20081107 Security fixes completed mailing-list
- ADV-2008-3364 vdb-entry
- GLSA-200907-15 vendor-advisory
- http://www.nagios.org/development/history/nagios-3x.php
- 33320 third-party-advisory
- [oss-security] 20081106 CVE request: Nagios (two issues) mailing-list
- 32156 vdb-entry
- 1022165 vdb-entry
- USN-698-3 vendor-advisory
- http://www.op5.com/support/news/389-important-security-fix-available-for-op5-monitor
- ADV-2008-3029 vdb-entry
- SSRT090060 vendor-advisory
- ADV-2009-1256 vdb-entry
- USN-698-1 vendor-advisory
- 35002 third-party-advisory