CyberRota Analysis
AI-GeneratedNagios Core versions prior to 4.5.12 are vulnerable to a cross-site request forgery (CSRF) flaw in the cmd.cgi component, allowing attackers to execute arbitrary commands as an authenticated user if the NagFormId cookie is not present. This vulnerability could lead to unauthorized actions being performed within the Nagios environment, potentially compromising system integrity. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently authenticated user without their knowledge or consent.