Nagios Looking Glass Addon for Nagios server/s3_download.php File Disclosure

medium Nessus Plugin ID 71159

Language:

Synopsis

The remote web server contains a PHP script that is affected by a file disclosure vulnerability.

Description

The Nagios Looking Glass Addon for Nagios installed on the remote host is affected by a file disclosure vulnerability. By sending a specially crafted request to the Addon's 'server/s3_download.php' script, a remote, unauthenticated attacker can leverage this vulnerability to obtain the contents of files in the 'sync-files' directory by specifying the filename in the 'filename' parameter and setting 'action' to 'update'. This could lead to the exposure of database credentials, as in the case of the file 's3_config.inc.php'.

Solution

There is no solution at this time.

Plugin Details

Severity: Medium

ID: 71159

File Name: nagios_looking_glass_file_disclosure.nasl

Version: 1.10

Type: remote

Family: CGI abuses

Published: 12/2/2013

Updated: 4/11/2022

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus

Risk Information

CVSS Score Rationale: Information disclosure

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: manual

Vulnerability Information

CPE: x-cpe:/a:nagios:nagios_looking_glass

Required KB Items: www/PHP

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No known exploits are available

Exploited by Nessus: true

Vulnerability Publication Date: 10/28/2013

Reference Information

BID: 63381

Detections

Analytics