CVE-2013-7108 Information disclosure in n/a
Authenticated remote attackers can read sensitive memory or crash Nagios Core via off-by-one errors in CGI variable processing.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-7108?
CVE-2013-7108 is a medium-severity vulnerability in n/a, published on 14 Jan 2014. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.
Weakness: CWE-20
Which versions are affected by CVE-2013-7108?
It affects 2 products.
Products include Icinga Icinga, Nagios Nagios.
How do I fix CVE-2013-7108?
Upgrade to a fixed version.
Is CVE-2013-7108 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-7108 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
- CVE-2025-48057 Icinga 2 certificate renewal might incorrectly renew an invalid certificate
- CVE-2020-29663 Security feature bypass in n/a
- CVE-2024-24820 Icinga Director configuration is susceptible to Cross-Site Request Forgery
- CVE-2018-6535 Information disclosure in n/a
- CVE-2020-14004 Path traversal in n/a
Sources
Also known as GHSA-48qr-xf75-jc6h, UBUNTU-CVE-2013-7108.