CVE-2023-40933: SQL Injection
A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the updatebannermessage() function.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40933?
The severity of CVE-2023-40933 is 8.8 (high).
How does the SQL injection vulnerability in Nagios XI v5.11.1 and below occur?
The SQL injection vulnerability in Nagios XI v5.11.1 and below occurs when authenticated attackers with announcement banner configuration privileges can execute arbitrary SQL commands via the ID parameter sent to the update_banner_message() function.
What software versions are affected by CVE-2023-40933?
The versions affected by CVE-2023-40933 are Nagios XI v5.11.1 and below.
How can an attacker exploit CVE-2023-40933?
An attacker can exploit CVE-2023-40933 by leveraging authenticated access with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the update_banner_message() function.
Are there any references available for CVE-2023-40933?
Yes, you can find references for CVE-2023-40933 at the following links: [http://nagios.com](http://nagios.com), [https://outpost24.com/blog/nagios-xi-vulnerabilities/](https://outpost24.com/blog/nagios-xi-vulnerabilities/), [https://www.nagios.com/products/security/](https://www.nagios.com/products/security/).