CVE-2021-3273

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Nagios XI's web system.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/leommxj/93edce6f8572cefe79a3d7da4389374eExploit, Third Party Advisory
https://www.nagios.com/downloads/nagios-xi/change-log/Release Notes, Vendor Advisory
https://gist.github.com/leommxj/93edce6f8572cefe79a3d7da4389374eExploit, Third Party Advisory
https://www.nagios.com/downloads/nagios-xi/change-log/Release Notes, Vendor Advisory

Timeline

Published: Feb 25, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327305.7XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulner CVE-2021-327315.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13 CVE-2021-327326.5### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually ti CVE-2021-327336.1Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versio CVE-2021-327345.3Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text appl CVE-2021-327355.4Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's `ListItem` component (used in the pages and files s CVE-2021-327367.5think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an CVE-2021-327374.8Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for CVE-2021-327386.5js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The `Utils.readChallengeTx` function used in SEP-10 CVE-2021-327398.8Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data CVE-2021-327407.5Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource con CVE-2021-327415.3Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of rat