Sign-up

ID

VAR-202108-1481


CVE

CVE-2021-37344


TITLE

Nagios XI Switch Wizard  In  OS  Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-010756

DESCRIPTION

Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (OS Command injection). (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2021-37344 // JVNDB: JVNDB-2021-010756 // VULHUB: VHN-399172 // VULMON: CVE-2021-37344

AFFECTED PRODUCTS

vendor:nagiosmodel:xi switch wizardscope:ltversion:2.5.7

Trust: 1.0

vendor:nagios enterprisesmodel:xi switch wizardscope:eqversion: -

Trust: 0.8

vendor:nagios enterprisesmodel:xi switch wizardscope:eqversion:2.5.7

Trust: 0.8

sources: JVNDB: JVNDB-2021-010756 // NVD: CVE-2021-37344

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-37344
value: CRITICAL

Trust: 1.0

NVD: CVE-2021-37344
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-202108-1355
value: CRITICAL

Trust: 0.6

VULHUB: VHN-399172
value: HIGH

Trust: 0.1

VULMON: CVE-2021-37344
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-37344
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-399172
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-37344
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2021-37344
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-399172 // VULMON: CVE-2021-37344 // JVNDB: JVNDB-2021-010756 // CNNVD: CNNVD-202108-1355 // NVD: CVE-2021-37344

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.1

problemtype:OS Command injection (CWE-78) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-399172 // JVNDB: JVNDB-2021-010756 // NVD: CVE-2021-37344

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202108-1355

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202108-1355

PATCH

title:Nagios XI Change Logurl:https://www.nagios.com/downloads/nagios-xi/change-log/

Trust: 0.8

sources: JVNDB: JVNDB-2021-010756

EXTERNAL IDS

db:NVDid:CVE-2021-37344

Trust: 3.4

db:JVNDBid:JVNDB-2021-010756

Trust: 0.8

db:CNNVDid:CNNVD-202108-1355

Trust: 0.6

db:VULHUBid:VHN-399172

Trust: 0.1

db:VULMONid:CVE-2021-37344

Trust: 0.1

sources: VULHUB: VHN-399172 // VULMON: CVE-2021-37344 // JVNDB: JVNDB-2021-010756 // CNNVD: CNNVD-202108-1355 // NVD: CVE-2021-37344

REFERENCES

url:https://www.nagios.com/downloads/nagios-xi/change-log/

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2021-37344

Trust: 0.8

url:https://cwe.mitre.org/data/definitions/78.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-399172 // VULMON: CVE-2021-37344 // JVNDB: JVNDB-2021-010756 // CNNVD: CNNVD-202108-1355 // NVD: CVE-2021-37344

SOURCES

db:VULHUBid:VHN-399172
db:VULMONid:CVE-2021-37344
db:JVNDBid:JVNDB-2021-010756
db:CNNVDid:CNNVD-202108-1355
db:NVDid:CVE-2021-37344

LAST UPDATE DATE

2024-08-14T15:37:58.656000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-399172date:2021-08-24T00:00:00
db:VULMONid:CVE-2021-37344date:2021-08-24T00:00:00
db:JVNDBid:JVNDB-2021-010756date:2022-07-07T05:53:00
db:CNNVDid:CNNVD-202108-1355date:2021-08-25T00:00:00
db:NVDid:CVE-2021-37344date:2021-08-24T14:17:17.803

SOURCES RELEASE DATE

db:VULHUBid:VHN-399172date:2021-08-13T00:00:00
db:VULMONid:CVE-2021-37344date:2021-08-13T00:00:00
db:JVNDBid:JVNDB-2021-010756date:2022-07-07T00:00:00
db:CNNVDid:CNNVD-202108-1355date:2021-08-13T00:00:00
db:NVDid:CVE-2021-37344date:2021-08-13T12:15:07.007