Home

Description

Nagios XI versions prior to 5.7.5 contain a SQL injection vulnerability in the SNMP Trap Interface edit page. Exploitation requires an account with administrative privileges to access the affected interface. A user with administrative access could supply crafted input that is not properly sanitized, allowing SQL injection that may lead to unauthorized disclosure or modification of application data or execution of arbitrary SQL commands against the backend database.

PUBLISHED Reserved 2025-10-30 | Published 2025-10-30 | Updated 2025-10-31 | Assigner VulnCheck




HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unaffected

Any version before 5.7.5
affected

Credits

Matthew Aberegg finder

References

www.nagios.com/changelog/nagios-xi/ release-notes patch

www.vulncheck.com/...-sqli-via-snmp-trap-interface-edit-page third-party-advisory

cve.org (CVE-2020-36869)

nvd.nist.gov (CVE-2020-36869)

Download JSON