Nagios Core
CVE-2020-35269
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding - deleting for hosts or servers.
AnalysisAI
Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding - deleting for hosts or servers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding - deleting for hosts or servers. Affected products include: Nagios Nagios Core. Version information: version 4.2.4.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.
More in Nagios Core
View allqh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to
qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to
Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered
Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this f
Remote code execution in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows authenticated UI users to ru
Authenticated remote code execution in Nagios Core (before 4.5.13) and Nagios XI (before 2026R1.5) is achievable via OS
Cross-site request forgery in Nagios Core (before 4.5.13) and Nagios XI (before 2026R1.5) allows an attacker to execute
Cross-site request forgery in Nagios Core before 4.5.12 enables remote attackers to execute arbitrary monitoring command
Cross-site request forgery protection bypass in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows unaut
DOM-based cross-site scripting in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows an authenticated lo
Reflected cross-site scripting in Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 allows unauthenticated remote
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today