CVE-2021-3277

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Jun 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327707.5Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic CVE-2021-327718.1Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflo CVE-2021-327728.8Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious characters CVE-2021-327737.5Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluate CVE-2021-327745.4DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no pr CVE-2021-327756.5Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field valu CVE-2021-327768.8Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Win CVE-2021-327778.3Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when e CVE-2021-327787.5Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’CVE-2021-327798.3Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy CVE-2021-32789.8Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection . Using this vulnera CVE-2021-327807.5Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy