The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4149 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4149-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     May 01, 2025                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : nagvis     Version        : 1:1.9.25-2+deb11u1     CVE ID         : CVE-2021-33178 CVE-2022-3979 CVE-2022-46945 CVE-2023-46287                      CVE-2024-13722 CVE-2024-13723 CVE-2024-47093

    Multiple vulnerabilities were discovered in nagvis, a visualization     addon for Nagios or Icinga.

    CVE-2021-33178

       Due to an authenticated path traversal vulnerability, a malicious actor        has the ability to arbitrarily delete files on the local system.

    CVE-2022-3979

       Due to a type juggling vulnerability, a remote attacker could        successfully guess an authentication cookie.

    CVE-2022-46945

       An attacker can read arbitrary files.

    CVE-2023-46287

       A XSS vulnerability exists in a function.

    CVE-2024-13722 / CVE-2024-47093

       Multiple XSS vulnerabilities exist.

    CVE-2024-13723 / CVE-2024-47093

       Multiple RCE vulnerabilities exist. An authenticated attacker with        administrative level privileges is able to upload a malicious PHP file        and modify specific settings to execute the contents of the file as        PHP.

    For Debian 11 bullseye, these problems have been fixed in version     1:1.9.25-2+deb11u1.

    We recommend that you upgrade your nagvis packages.

    For the detailed security status of nagvis please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nagvis

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-4149 : nagvis - security update

high Nessus Plugin ID 235043

Version 1.1