NVD

Id
38306  
Name
CVE-2013-2214  
Description
status.cgi in Nagios 4.0 before 4.0 beta4 and 3.x before 3.5.1 does not properly restrict access to certain users that are a contact for a service, which allows remote authenticated users to obtain sensitive information about hostnames via the servicegroup (1) overview, (2) summary, or (3) grid style in status.cgi. NOTE: this behavior is by design in most 3.x versions, but the upstream vendor "decided to change it for Nagios 4" and 3.5.1.  
Reject
 
CVSS Version
2  
CVSS Score
4  
Severity
Medium  
CVSS Base Score
4  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:N/A:N)  
Pub Date
2017-01-18  
Published
2014-02-10  
Modified Date
2014-02-25  
Seq
2013-2214  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
195898 38306 CVE-2013-2214 openSUSE-SU-2013:1158  View
195899 38306 CVE-2013-2214 openSUSE-SU-2013:1160  View
195900 38306 CVE-2013-2214 [oss-security] 20130626 CVE request: unauthorized host/service views displayed in servicegroup view  View
195901 38306 CVE-2013-2214 [oss-security] 20130626 Re: CVE request: unauthorized host/service views displayed in servicegroup view  View
195902 38306 CVE-2013-2214 http://tracker.nagios.org/view.php?id=456  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
24448 JVNDB-2013-006023 Nagios の status.cgi におけるホスト名についての重要な情報を取得される脆弱性 Nagios の status.cgi は、サービスの連絡先 (contact) である特定のユーザへのアクセスを適切に制限しないため、ホスト名についての重要な情報を取得される脆弱性が存在します。 CVE-2013-2214 62156 CVE-2013-2214 38306 4 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-006023.html 2013-09-04 2014-02-12 View