Vulnerability Details : CVE-2018-15708
Public exploit exists!
Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request.
Products affected by CVE-2018-15708
- cpe:2.3:a:nagios:nagios_xi:5.5.6:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-15708
46.79%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 98 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2018-15708
-
Nagios XI Magpie_debug.php Root Remote Code Execution
Disclosure Date: 2018-11-14First seen: 2020-04-26exploit/linux/http/nagios_xi_magpie_debugThis module exploits two vulnerabilities in Nagios XI <= 5.5.6: CVE-2018-15708 which allows for unauthenticated remote code execution and CVE-2018-15710 which allows for local privilege escalation. When combined, these two vulnerabilities allow execution of a
CVSS scores for CVE-2018-15708
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
References for CVE-2018-15708
-
http://packetstormsecurity.com/files/153433/Nagios-XI-Magpie_debug.php-Root-Remote-Code-Execution.html
Nagios XI Magpie_debug.php Root Remote Code Execution ≈ Packet Storm
-
https://www.exploit-db.com/exploits/46221/
Nagios XI 5.5.6 - Remote Code Execution / Privilege EscalationExploit;Third Party Advisory;VDB Entry
-
https://www.tenable.com/security/research/tra-2018-37
[R2] Nagios XI Multiple Vulnerabilities - Research Advisory | Tenable®Exploit;Third Party Advisory
Jump to