security advisoryremote code executioncross site scripting
Multiple vulnerabilities were discovered in nagvis, a visualization addon for Nagios or Icinga. CVE-2021-33178 . ------------------------------------------------------------------------- Debian LTS Advisory DLA-4149-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Daniel Leidert May 01, 2025 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : nagvis Version : 1:1.9.25-2+deb11u1 CVE ID : CVE-2021-33178 CVE-2022-3979 CVE-2022-46945 CVE-2023-46287 CVE-2024-13722 CVE-2024-13723 CVE-2024-47093 Multiple vulnerabilities were discovered in nagvis, a visualization addon for Nagios or Icinga. CVE-2021-33178 Due to an authenticated path traversal vulnerability, a malicious actor has the ability to arbitrarily delete files on the local system. CVE-2022-3979 Due to a type juggling vulnerability, a remote attacker could successfully guess an authentication cookie. CVE-2022-46945 An attacker can read arbitrary files. CVE-2023-46287 A XSS vulnerability exists in a function. CVE-2024-13722 / CVE-2024-47093 Multiple XSS vulnerabilities exist. CVE-2024-13723 / CVE-2024-47093 Multiple RCE vulnerabilities exist. An authenticated attacker with administrative level privileges is able to upload a malicious PHP file and modify specific settings to execute the contents of the file as PHP. For Debian 11 bullseye, these problems have been fixed in version 1:1.9.25-2+deb11u1. We recommend that you upgrade your nagvis packages. For the detailed security status of nagvis please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/nagvis Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at:https://wiki.debian.org/LTS . The latest Nagvis patch for Debian LTS resolves serious vulnerabilities, encompassing remote command execution and cross-site scripting (XSS) concerns.. Debian LTS, nagvis update, security vulnerabilities, remote code execution, Debian security advisory. . Severity: Critical. LinuxSecurity.com Team
May 01, 2025
•Critical
Debian LTS