CVE-2021-40344: Malicious File Upload
Published Oct 26, 2021
·Updated
An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. Therefore it is possible to upload a crafted PHP script to achieve remote command execution.
Affected Software
1 affected component
Nagios Nagios XI=5.8.5
Event History
Oct 26, 2021
CVE Published
via MITRE·10:52 AM
Data Sourced
via MITRE·10:52 AM
Description
Frequently Asked Questions
1
What is CVE-2021-40344?
CVE-2021-40344 is a vulnerability in Nagios XI 5.8.5 that allows remote command execution.
2
How severe is CVE-2021-40344?
CVE-2021-40344 has a severity level of 7.2 (High).
3
How does CVE-2021-40344 affect Nagios XI?
CVE-2021-40344 affects Nagios XI version 5.8.5.
4
What is the CWE ID for CVE-2021-40344?
The CWE ID for CVE-2021-40344 is CWE-434.
5
How can I fix CVE-2021-40344?
To fix CVE-2021-40344, update Nagios XI to the latest version available and apply any patches or mitigations provided by the vendor.