Servers and applications
CVE-2018-15711
Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key to execute API calls at elevated privileges.
- Severity
- High 8.8
- Published
- 14 Nov 2018
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 36% in the next 30 daysHigher than 98% of CVEs. EPSS by FIRST, 10 Nov 2026
- Weakness
- OS command injection (CWE-78)
- Attack
- Over the network · Needs a user account · No user action needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Nagios XIServers and applications · cpe:a:nagios:nagios_xi |
|