CVE-2020-28907: Critical severity nagios fusion vulnerability
Published May 24, 2021
·Updated
Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an untrusted update package in upgradetolatest.sh.
Affected Software
1 affected component
Nagios Fusion<=4.1.8
Event History
May 24, 2021
CVE Published
via MITRE·12:43 PM
Data Sourced
via MITRE·12:43 PM
Description
Frequently Asked Questions
1
What is CVE-2020-28907?
CVE-2020-28907 is a vulnerability in Nagios Fusion 4.1.8 and earlier that allows for Escalation of Privileges or Code Execution as root.
2
What is the severity of CVE-2020-28907?
CVE-2020-28907 has a severity rating of critical (9.8).
3
How does CVE-2020-28907 occur?
CVE-2020-28907 occurs due to incorrect SSL certificate validation when downloading an untrusted update package in upgrade_to_latest.sh.
4
How can CVE-2020-28907 be exploited?
CVE-2020-28907 can be exploited by an attacker to escalate privileges or execute arbitrary code as root.
5
Is there a fix available for CVE-2020-28907?
Yes, users should update Nagios Fusion to a version that is not affected by CVE-2020-28907.