CVE-2018-17148

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote attackers to gain access to configuration files containing confidential credentials.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXTRelease Notes, Vendor Advisory
https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXTRelease Notes, Vendor Advisory

Timeline

Published: Jun 19, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-17155.4IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Java CVE-2018-171506.1Intersystems Cache 2017.2.2.865.0 allows XSS.CVE-2018-171515.4Intersystems Cache 2017.2.2.865.0 has Incorrect Access Control.CVE-2018-171526.4Intersystems Cache 2017.2.2.865.0 allows XXE.CVE-2018-171539.8It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthe CVE-2018-171545.5In FreeBSD before 11.2-STABLE(r338987), 11.2-RELEASE-p4, and 11.1-RELEASE-p15, due to insufficient memory checking in the freebsd4_getfsstat CVE-2018-171555.5In FreeBSD before 11.2-STABLE(r338983), 11.2-RELEASE-p4, 11.1-RELEASE-p15, 10.4-STABLE(r338984), and 10.4-RELEASE-p13, due to insufficient i CVE-2018-171565.9In FreeBSD before 11.2-STABLE(r340268) and 11.2-RELEASE-p5, due to incorrectly accounting for padding on 64-bit platforms, a buffer underwri CVE-2018-171579.8In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error when handling opcodes can cause memory corruption by s CVE-2018-171587.5In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error can occur when handling the client address length fiel CVE-2018-171597.5In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, the NFS server lacks a bounds check in the READDIRPLUS NFS request. Unprivileged CVE-2018-17166.1IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaSc