Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-48548 →

DEBIAN-CVE-2026-48548

Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when th...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently authenticated user without their knowledge or consent.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 nagios4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-4+deb12u1"}]}]

Debian:13 nagios4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-4.1+deb13u1"}]}]

Debian:14 nagios4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.12+ds-1"}]}]

Références

advisory security-tracker.debian.org