CVE-2020-28904 Privilege escalation in n/a
Attackers can escalate privileges to the nagios user and execute arbitrary code by installing a malicious component with PHP code in Nagios Fusion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-28904?
CVE-2020-28904 is a critical vulnerability in n/a, published on 24 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code.
Weakness: CWE-269
Which versions are affected by CVE-2020-28904?
It affects 1 product.
Products include Nagios Fusion.
How do I fix CVE-2020-28904?
No fix has been published for CVE-2020-28904 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-28904 being exploited?
There is no known exploitation of CVE-2020-28904 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-p7jw-jxr7-pm98.