CVE-2024-14002: Nagios XI < 2024R1.1.4 Authenticated Local File Inclusion via NagVis
Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An authenticated user can supply crafted path values that cause the server to include local files, potentially exposing sensitive information from the underlying host.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nagios XIto a version that resolves this vulnerability.Fixed in 2024R1.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2024-14002?
CVE-2024-14002 is classified as a medium severity vulnerability.
How do I fix CVE-2024-14002?
To fix CVE-2024-14002, update Nagios XI to version 2024R1.1.4 or later.
What systems are affected by CVE-2024-14002?
CVE-2024-14002 affects Nagios XI versions prior to 2024R1.1.4.
What type of vulnerability is CVE-2024-14002?
CVE-2024-14002 is a local file inclusion (LFI) vulnerability.
Who can exploit CVE-2024-14002?
An authenticated user can exploit CVE-2024-14002 to include local files on the server.