CVE-2018-8735

high

Description

Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection.

References

https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f

https://www.exploit-db.com/exploits/44969/

https://www.exploit-db.com/exploits/44560/

https://www.nagios.com/downloads/nagios-xi/change-log/

https://blog.redactedsec.net/exploits/2018/04/26/nagios.html

https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT

Details

Source: Mitre, NVD

Published: 2018-04-18

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H