CVE-2019-9165: SQL Injection
Published Mar 28, 2019
·Updated
SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys and malicious user id.
Affected Software
1 affected component
Nagios Nagios XI<5.5.11
Event History
Mar 28, 2019
CVE Published
via MITRE·06:59 PM
Data Sourced
via MITRE·06:59 PM
Description
Data Sourced
via NVD·07:29 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2019-9165?
CVE-2019-9165 is rated as critical due to its potential for remote exploitation via SQL injection.
2
How do I fix CVE-2019-9165?
To fix CVE-2019-9165, upgrade to Nagios XI version 5.5.11 or later, which addresses this vulnerability.
3
What types of attacks can be executed through CVE-2019-9165?
CVE-2019-9165 allows attackers to execute arbitrary SQL commands through the API by exploiting the vulnerability.
4
Which versions of Nagios XI are affected by CVE-2019-9165?
CVE-2019-9165 affects Nagios XI versions prior to 5.5.11.
5
Is authentication required to exploit CVE-2019-9165?
Yes, exploitation of CVE-2019-9165 requires authentication with a malicious user ID.