CVE-2020-13977

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-06-09 · updated 2026-06-17
Weakness: CWE-829

Description

Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been mistakenly associated with CVE-2020-1408.

Affected products

Fedoraproject Fedora: 32, 33, 34
Nagios Enterprises nagios: 4.4.5

References

https://anhtai.me/nagios-core-4-4-5-url-injection/
https://github.com/sawolf/nagioscore/tree/url-injection-fix
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P6NHNG2SJAM6DXVTXQH3AOJ4WQVKJUE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H7T6MSDWMBJEVVFSOK7DOYJJWDAFQCEQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUEIABR4Y6L5J5MZDFWU46ZWXMJO64U3/
https://www.nagios.org/projects/nagios-core/history/4x/
https://anhtai.me/nagios-core-4-4-5-url-injection/
https://github.com/sawolf/nagioscore/tree/url-injection-fix
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P6NHNG2SJAM6DXVTXQH3AOJ4WQVKJUE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H7T6MSDWMBJEVVFSOK7DOYJJWDAFQCEQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUEIABR4Y6L5J5MZDFWU46ZWXMJO64U3/
https://www.nagios.org/projects/nagios-core/history/4x/

Get alerted when CVE-2020-13977 or the next vulnerability affects your stack