CVE-2020-35269

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding – deleting for hosts or servers.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/MoSalah20/d1d40b43eafba0bd22ee4cddecad3cbcThird Party Advisory
https://gist.github.com/MoSalah20/d1d40b43eafba0bd22ee4cddecad3cbcThird Party Advisory

Timeline

Published: Dec 23, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-35278.6A vulnerability in the Polaris kernel of Cisco Catalyst 9200 Series Switches could allow an unauthenticated, remote attacker to crash the de CVE-2020-352709.1Student Result Management System In PHP With Source Code is affected by SQL injection. An attacker can able to access of Admin Panel and man CVE-2020-352714.8Employee Performance Evaluation System in PHP/MySQLi with Source Code 1.0 is affected by cross-site scripting (XSS) in the Employees, First CVE-2020-352724.8Employee Performance Evaluation System in PHP/MySQLi with Source Code 1.0 is affected by cross-site scripting (XSS) in the Admin Portal in t CVE-2020-352738.0EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery (CSRF) to remotely gain privil CVE-2020-352744.8DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain remote privileges. An attacker could compromise CVE-2020-352755.4Coastercms v5.8.18 is affected by cross-site Scripting (XSS). A user can steal a cookie and make the user redirect to any malicious website CVE-2020-352769.8EgavilanMedia ECM Address Book 1.0 is affected by SQL injection. An attacker can bypass the Admin Login panel through SQLi and get Admin acc CVE-2020-35287.5A vulnerability in the OSPF Version 2 (OSPFv2) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat CVE-2020-352847.5Flamingo (aka FlamingoIM) through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfe CVE-2020-35297.5A vulnerability in the SSL VPN negotiation process for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (CVE-2020-352967.5ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboard access.