Cross-site request forgery (CSRF) vulnerability in cmd.cgi in (1) Nagios 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote attackers to s

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• nagios nagiosup to 3.0.4 inclusive
• nagios nagios1.0
• nagios nagios1.0_b1
• nagios nagios1.0_b2
• nagios nagios1.0_b3
• nagios nagios1.0b1
• nagios nagios1.0b2
• nagios nagios1.0b3
• nagios nagios1.0b4
• nagios nagios1.0b5
• nagios nagios1.0b6
• nagios nagios1.1
• nagios nagios1.2
• nagios nagios1.3
• nagios nagios1.4
• nagios nagios1.4.1
• nagios nagios2.0
• nagios nagios2.0b1
• nagios nagios2.0b2
• nagios nagios2.0b3

Other highest-scoring records for the same primary product.

• CVE-2009-2288statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) T
  55Plan
• CVE-2012-6096Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2,
  50Plan
• CVE-2016-9565MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files b
  46Plan
• CVE-2002-1959Nagios 1.0b1 through 1.0b3 allows remote attackers to execute arbitrary commands via shell metacharacters in plugin output.
  41Plan
• CVE-2016-0726The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for
  40Plan
• CVE-2013-7108Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow
  40Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

State-changing requests rely on the session cookie the browser sends automatically; nothing verifies that the request came from the user’s own page.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1app.use(session({ cookie: { httpOnly: true } }));2app.post("/account/address", updateAddress);

1app.use(session({ cookie: { httpOnly: true, sameSite: "lax" } }));2app.post("/account/address", csrfProtection, updateAddress);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.