CVE-2024-14009: Nagios XI < 2024R1.0.1 Privilege Escalation via System Profile
Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component. The System Profile feature is an administrative diagnostic/configuration capability. Due to improper access controls and unsafe handling of exported/imported profile data and operations, an authenticated administrator could exploit this vulnerability to execute actions on the underlying XI host outside the application's security scope. Successful exploitation may allow an administrator to obtain root privileges on the XI server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nagios XIto a version that resolves this vulnerability.Fixed in 2024R1.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-14009?
CVE-2024-14009 is a privilege escalation vulnerability that poses a high risk to affected systems.
How do I fix CVE-2024-14009?
To mitigate CVE-2024-14009, upgrade Nagios XI to version 2024R1.0.1 or later.
What are the potential consequences of CVE-2024-14009?
Exploiting CVE-2024-14009 may allow unauthorized users to gain administrative access to the Nagios XI system.
Which versions of Nagios XI are affected by CVE-2024-14009?
CVE-2024-14009 affects all Nagios XI versions prior to 2024R1.0.1.
What component of Nagios XI does CVE-2024-14009 involve?
CVE-2024-14009 involves a vulnerability in the System Profile component of Nagios XI.