CVE-2008-5028

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-11-10 · updated 2026-06-16
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in cmd.cgi in (1) Nagios 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote attackers to send commands to the Nagios process, and trigger execution of arbitrary programs by this process, via unspecified HTTP requests.

Affected products

Nagios Enterprises nagios: through 3.0.4; 1.0, 1.0_b1, 1.0_b2, 1.0_b3, 1.0b1, 1.0b2 (+47)
Op5 Monitor: through 4.0.0; 2.4, 2.6, 2.8, 3.0, 3.0.0, 3.2 (+4)

References

http://git.op5.org/git/?p=nagios.git%3Ba=commit%3Bh=814d8d4d1a73f7151eeed187c0667585d79fea18
http://marc.info/?l=bugtraq&m=124156641928637&w=2
http://osvdb.org/49678
http://secunia.com/advisories/32610
http://secunia.com/advisories/32630
http://secunia.com/advisories/33320
http://secunia.com/advisories/35002
http://security.gentoo.org/glsa/glsa-200907-15.xml
http://sourceforge.net/mailarchive/forum.php?thread_name=4914396D.5010009%40op5.se&forum_name=nagios-devel
http://www.op5.com/support/news/389-important-security-fix-available-for-op5-monitor
http://www.openwall.com/lists/oss-security/2008/11/06/2
http://www.securitytracker.com/id?1022165

Get alerted when CVE-2008-5028 or the next vulnerability affects your stack