VULNERABILITY INTELLIGENCE

CVE-2021-37223

CVSS score6.5 MEDIUM
EPSS probability4.98%
CISA KEVNot currently listed
Published2021-10-05
Last modified2026-07-09
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI application. Due to lack of input sanitisation, the target page can be replaced with an SSRF payload to access internal resources or disclose local system files.

Weakness classification

  • nvd@nist.gov: CWE-918

Primary references