Debian dla-4149 : nagvis - security update

high Nessus Plugin ID 235043

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4149 advisory.

------------------------------------------------------------------------- Debian LTS Advisory DLA-4149-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert May 01, 2025 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package : nagvis Version : 1:1.9.25-2+deb11u1 CVE ID : CVE-2021-33178 CVE-2022-3979 CVE-2022-46945 CVE-2023-46287 CVE-2024-13722 CVE-2024-13723 CVE-2024-47093

Multiple vulnerabilities were discovered in nagvis, a visualization addon for Nagios or Icinga.

CVE-2021-33178

Due to an authenticated path traversal vulnerability, a malicious actor has the ability to arbitrarily delete files on the local system.

CVE-2022-3979

Due to a type juggling vulnerability, a remote attacker could successfully guess an authentication cookie.

CVE-2022-46945

An attacker can read arbitrary files.

CVE-2023-46287

A XSS vulnerability exists in a function.

CVE-2024-13722 / CVE-2024-47093

Multiple XSS vulnerabilities exist.

CVE-2024-13723 / CVE-2024-47093

Multiple RCE vulnerabilities exist. An authenticated attacker with administrative level privileges is able to upload a malicious PHP file and modify specific settings to execute the contents of the file as PHP.

For Debian 11 bullseye, these problems have been fixed in version 1:1.9.25-2+deb11u1.

We recommend that you upgrade your nagvis packages.

For the detailed security status of nagvis please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/nagvis

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Attachment:
signature.asc Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the nagvis packages.

Plugin Details

Severity: High

ID: 235043

File Name: debian_DLA-4149.nasl

Version: 1.1

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 5/1/2025

Updated: 5/1/2025

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:C

CVSS Score Source: CVE-2021-33178

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.3

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2022-3979

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:nagvis-demos, p-cpe:/a:debian:debian_linux:nagvis, cpe:/o:debian:debian_linux:11.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/1/2025

Vulnerability Publication Date: 10/14/2021

Reference Information

CVE: CVE-2021-33178, CVE-2022-3979, CVE-2022-46945, CVE-2023-46287, CVE-2024-13722, CVE-2024-13723, CVE-2024-47093

Detections

Analytics