{"id":6537,"date":"2023-11-15T21:26:18","date_gmt":"2023-11-16T03:26:18","guid":{"rendered":"https:\/\/josea112.sg-host.com\/publicacion\/alert-2023-02-critical-vulnerabilities-in-nagios-products\/"},"modified":"2024-10-22T10:01:01","modified_gmt":"2024-10-22T15:01:01","slug":"2023-02-critical-vulnerabilities-in-nagios-products","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/2023-02-critical-vulnerabilities-in-nagios-products\/","title":{"rendered":"Alert 2023-02 &#8211; Critical Vulnerabilities in Nagios Products"},"content":{"rendered":"<p style=\"font-weight: 400;\">There have been <i><a href=\"https:\/\/www.nagios.com\/products\/security\/\"><em>reported<\/em><\/a><\/i> critical SQL Injection vulnerabilities affecting the Nagios XI network monitoring software, which could result in privilege escalation.<\/p>\n<p style=\"font-weight: 400;\">The list of vulnerabilities is described below:<\/p>\n<ul>\n<li><i><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-40933\">CVE-2023-40933<\/a><\/i>&#8211; SQL Injection in the ad banner configuration with High criticality with score 8.8, allows authenticated attackers with ad banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the update_banner_message() function.<\/li>\n<li><i><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-40934\">CVE-2023-40934<\/a><\/i>&#8211; SQL Injection in host\/service escalation in Core Configuration Manager (CCM) with High criticality with score 7.<\/li>\n<li><i><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-40931\">CVE-2023-40931<\/a><\/i>&#8211; SQL injection in banner that recognizes the Medium criticality endpoint with a score of 6.5. Allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to \/nagiosxi\/admin\/banner_message-ajaxhelper.php. <\/li>\n<li><i><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-40932\">CVE-2023-40932<\/a><\/i>&#8211; Cross-Site Scripting in the custom logo component with Medium criticality with score 5.4. Allows authenticated attackers with access to the custom logo component to inject javascript or HTML of their choice via the alternate text field. This affects all pages containing the navigation bar, including the login page, meaning the attacker can steal plain text credentials.  <\/li>\n<\/ul>\n","protected":false},"featured_media":5681,"template":"","class_list":["post-6537","publicacion","type-publicacion","status-publish","has-post-thumbnail","hentry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"There have been reported critical SQL Injection vulnerabilities affecting the Nagios XI network monitoring software, which could result in privilege escalation. The list of vulnerabilities is described below: CVE-2023-40933- SQL Injection in the ad banner configuration with High criticality with score 8.8, allows authenticated attackers with ad banner configuration privileges to execute arbitrary SQL commands\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/beaconlab.us\/en\/publication\/2023-02-critical-vulnerabilities-in-nagios-products\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Beacon Lab - CSIRT by Cybolt\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Alert 2023-02 \u2013 Critical Vulnerabilities in Nagios Products - Beacon Lab\" \/>\n\t\t<meta property=\"og:description\" content=\"There have been reported critical SQL Injection vulnerabilities affecting the Nagios XI network monitoring software, which could result in privilege escalation. The list of vulnerabilities is described below: CVE-2023-40933- SQL Injection in the ad banner configuration with High criticality with score 8.8, allows authenticated attackers with ad banner configuration privileges to execute arbitrary SQL commands\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/beaconlab.us\/en\/publication\/2023-02-critical-vulnerabilities-in-nagios-products\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2023\/11\/nagios-xi-1024x512-20190225.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2023\/11\/nagios-xi-1024x512-20190225.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t\t<meta property=\"og:image:height\" content=\"512\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-11-16T03:26:18+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-10-22T15:01:01+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@BeaconLabMX\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Alert 2023-02 \u2013 Critical Vulnerabilities in Nagios Products - Beacon Lab\" \/>\n\t\t<meta name=\"twitter:description\" content=\"There have been reported critical SQL Injection vulnerabilities affecting the Nagios XI network monitoring software, which could result in privilege escalation. The list of vulnerabilities is described below: CVE-2023-40933- SQL Injection in the ad banner configuration with High criticality with score 8.8, allows authenticated attackers with ad banner configuration privileges to execute arbitrary SQL commands\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2023\/11\/nagios-xi-1024x512-20190225.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2023-02-critical-vulnerabilities-in-nagios-products\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2023-02-critical-vulnerabilities-in-nagios-products\\\/#listItem\",\"name\":\"Alert 2023-02 &#8211; Critical Vulnerabilities in Nagios Products\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2023-02-critical-vulnerabilities-in-nagios-products\\\/#listItem\",\"position\":2,\"name\":\"Alert 2023-02 &#8211; Critical Vulnerabilities in Nagios Products\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"name\":\"Home\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"telephone\":\"+528007374357\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.mx\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/BeaconLab_V2-03.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2023-02-critical-vulnerabilities-in-nagios-products\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2023-02-critical-vulnerabilities-in-nagios-products\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/twitter.com\\\/BeaconLabMX\",\"https:\\\/\\\/www.linkedin.com\\\/showcase\\\/beaconlabmx\"]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2023-02-critical-vulnerabilities-in-nagios-products\\\/#webpage\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2023-02-critical-vulnerabilities-in-nagios-products\\\/\",\"name\":\"Alert 2023-02 \\u2013 Critical Vulnerabilities in Nagios Products - Beacon Lab\",\"description\":\"There have been reported critical SQL Injection vulnerabilities affecting the Nagios XI network monitoring software, which could result in privilege escalation. The list of vulnerabilities is described below: CVE-2023-40933- SQL Injection in the ad banner configuration with High criticality with score 8.8, allows authenticated attackers with ad banner configuration privileges to execute arbitrary SQL commands\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2023-02-critical-vulnerabilities-in-nagios-products\\\/#breadcrumblist\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/wp-content\\\/uploads\\\/2023\\\/11\\\/nagios-xi-1024x512-20190225.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2023-02-critical-vulnerabilities-in-nagios-products\\\/#mainImage\",\"width\":1024,\"height\":512},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2023-02-critical-vulnerabilities-in-nagios-products\\\/#mainImage\"},\"datePublished\":\"2023-11-15T21:26:18-06:00\",\"dateModified\":\"2024-10-22T10:01:01-06:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Alert 2023-02 \u2013 Critical Vulnerabilities in Nagios Products - Beacon Lab","description":"There have been reported critical SQL Injection vulnerabilities affecting the Nagios XI network monitoring software, which could result in privilege escalation. The list of vulnerabilities is described below: CVE-2023-40933- SQL Injection in the ad banner configuration with High criticality with score 8.8, allows authenticated attackers with ad banner configuration privileges to execute arbitrary SQL commands","canonical_url":"https:\/\/beaconlab.us\/en\/publication\/2023-02-critical-vulnerabilities-in-nagios-products\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BreadcrumbList","@id":"https:\/\/beaconlab.us\/en\/publication\/2023-02-critical-vulnerabilities-in-nagios-products\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/beaconlab.us\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/2023-02-critical-vulnerabilities-in-nagios-products\/#listItem","name":"Alert 2023-02 &#8211; Critical Vulnerabilities in Nagios Products"}},{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/2023-02-critical-vulnerabilities-in-nagios-products\/#listItem","position":2,"name":"Alert 2023-02 &#8211; Critical Vulnerabilities in Nagios Products","previousItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","name":"Home"}}]},{"@type":"Organization","@id":"https:\/\/beaconlab.us\/en\/#organization","name":"Beacon Lab","description":"CSIRT by Cybolt","url":"https:\/\/beaconlab.us\/en\/","telephone":"+528007374357","logo":{"@type":"ImageObject","url":"https:\/\/beaconlab.mx\/wp-content\/uploads\/2023\/12\/BeaconLab_V2-03.png","@id":"https:\/\/beaconlab.us\/en\/publication\/2023-02-critical-vulnerabilities-in-nagios-products\/#organizationLogo"},"image":{"@id":"https:\/\/beaconlab.us\/en\/publication\/2023-02-critical-vulnerabilities-in-nagios-products\/#organizationLogo"},"sameAs":["https:\/\/twitter.com\/BeaconLabMX","https:\/\/www.linkedin.com\/showcase\/beaconlabmx"]},{"@type":"WebPage","@id":"https:\/\/beaconlab.us\/en\/publication\/2023-02-critical-vulnerabilities-in-nagios-products\/#webpage","url":"https:\/\/beaconlab.us\/en\/publication\/2023-02-critical-vulnerabilities-in-nagios-products\/","name":"Alert 2023-02 \u2013 Critical Vulnerabilities in Nagios Products - Beacon Lab","description":"There have been reported critical SQL Injection vulnerabilities affecting the Nagios XI network monitoring software, which could result in privilege escalation. The list of vulnerabilities is described below: CVE-2023-40933- SQL Injection in the ad banner configuration with High criticality with score 8.8, allows authenticated attackers with ad banner configuration privileges to execute arbitrary SQL commands","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/beaconlab.us\/en\/#website"},"breadcrumb":{"@id":"https:\/\/beaconlab.us\/en\/publication\/2023-02-critical-vulnerabilities-in-nagios-products\/#breadcrumblist"},"image":{"@type":"ImageObject","url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2023\/11\/nagios-xi-1024x512-20190225.png","@id":"https:\/\/beaconlab.us\/en\/publication\/2023-02-critical-vulnerabilities-in-nagios-products\/#mainImage","width":1024,"height":512},"primaryImageOfPage":{"@id":"https:\/\/beaconlab.us\/en\/publication\/2023-02-critical-vulnerabilities-in-nagios-products\/#mainImage"},"datePublished":"2023-11-15T21:26:18-06:00","dateModified":"2024-10-22T10:01:01-06:00"},{"@type":"WebSite","@id":"https:\/\/beaconlab.us\/en\/#website","url":"https:\/\/beaconlab.us\/en\/","name":"Beacon Lab","description":"CSIRT by Cybolt","inLanguage":"en-US","publisher":{"@id":"https:\/\/beaconlab.us\/en\/#organization"}}]},"og:locale":"en_US","og:site_name":"Beacon Lab - CSIRT by Cybolt","og:type":"article","og:title":"Alert 2023-02 \u2013 Critical Vulnerabilities in Nagios Products - Beacon Lab","og:description":"There have been reported critical SQL Injection vulnerabilities affecting the Nagios XI network monitoring software, which could result in privilege escalation. The list of vulnerabilities is described below: CVE-2023-40933- SQL Injection in the ad banner configuration with High criticality with score 8.8, allows authenticated attackers with ad banner configuration privileges to execute arbitrary SQL commands","og:url":"https:\/\/beaconlab.us\/en\/publication\/2023-02-critical-vulnerabilities-in-nagios-products\/","og:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2023\/11\/nagios-xi-1024x512-20190225.png","og:image:secure_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2023\/11\/nagios-xi-1024x512-20190225.png","og:image:width":1024,"og:image:height":512,"article:published_time":"2023-11-16T03:26:18+00:00","article:modified_time":"2024-10-22T15:01:01+00:00","twitter:card":"summary_large_image","twitter:site":"@BeaconLabMX","twitter:title":"Alert 2023-02 \u2013 Critical Vulnerabilities in Nagios Products - Beacon Lab","twitter:description":"There have been reported critical SQL Injection vulnerabilities affecting the Nagios XI network monitoring software, which could result in privilege escalation. The list of vulnerabilities is described below: CVE-2023-40933- SQL Injection in the ad banner configuration with High criticality with score 8.8, allows authenticated attackers with ad banner configuration privileges to execute arbitrary SQL commands","twitter:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2023\/11\/nagios-xi-1024x512-20190225.png"},"aioseo_meta_data":{"post_id":"6537","title":null,"description":null,"keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"WebPage","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2024-10-17 23:37:48","updated":"2025-09-24 05:48:29","seo_analyzer_scan_date":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/beaconlab.us\/en\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tAlert 2023-02 \u2013 Critical Vulnerabilities in Nagios Products\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/beaconlab.us\/en\/"},{"label":"Alert 2023-02 &#8211; Critical Vulnerabilities in Nagios Products","link":"https:\/\/beaconlab.us\/en\/publication\/2023-02-critical-vulnerabilities-in-nagios-products\/"}],"_links":{"self":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/6537","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion"}],"about":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/types\/publicacion"}],"version-history":[{"count":1,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/6537\/revisions"}],"predecessor-version":[{"id":7746,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/6537\/revisions\/7746"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media\/5681"}],"wp:attachment":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media?parent=6537"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}