CVE-2019-20197: OS Command Injection
Published Dec 31, 2019
·Updated
In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account.
Affected Software
1 affected component
Nagios Nagios XI=5.6.9
Event History
Dec 31, 2019
CVE Published
via MITRE·06:50 PM
Data Sourced
via MITRE·06:50 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-20197?
CVE-2019-20197 has a high severity due to its ability to allow authenticated users to execute arbitrary OS commands.
2
How do I fix CVE-2019-20197?
To fix CVE-2019-20197, upgrade Nagios XI to a patched version that addresses this vulnerability.
3
Who is affected by CVE-2019-20197?
Nagios XI version 5.6.9 is affected by CVE-2019-20197.
4
What type of vulnerability is CVE-2019-20197?
CVE-2019-20197 is a remote code execution vulnerability that can be exploited in a web application context.
5
How does CVE-2019-20197 occur?
CVE-2019-20197 occurs when shell metacharacters are improperly handled in the id parameter of schedulereport.php.