Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user.

CVE-2021-3193 · published 5 years ago
Summary

Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
nagios nagios_xi <= 5.7.0
cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*
Original advisory text
Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user.
Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
10% chance of attack within 30 days
Timeline
Published26 Jan 2021
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2021-3193 · NVD
Track software like this
Free during beta