In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15901
Reference (s):
- https://insinuator.net/2020/07/security-advisories-for-nagios-xi/
- https://www.nagios.com/downloads/nagios-xi/change-log/
- https://www.nagios.com/products/security/