CVE-2024-13997

{"id": "CVE-2024-13997", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-13997", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-05T15:05:09.210337Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Nagios", "modules": ["Migrate Server feature"], "product": "XI", "versions": [{"status": "affected", "version": "0", "lessThan": "2024R1.1.3", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-03T22:16:39.910", "references": [{"url": "https://www.nagios.com/changelog/nagios-xi/", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.nagios.com/products/security/#nagios-xi", "tags": ["Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-migrate-server-feature-to-root-on-host", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "Nagios XI versions prior to\u00a02024R1.1.3\u00a0contain a privilege escalation vulnerability in\u00a0which an authenticated administrator could leverage the Migrate Server feature to obtain root privileges on the underlying XI host. By abusing the migration workflow, an admin-level attacker could execute actions outside the intended security scope of the application, resulting in full control of the operating system."}, {"lang": "es", "value": "Versiones de Nagios XI anteriores a 2024R1.1.3 contienen una vulnerabilidad de escalada de privilegios en la que un administrador autenticado podr\u00eda aprovechar la funci\u00f3n Migrar Servidor para obtener privilegios de root en el host XI subyacente. Al abusar del flujo de trabajo de migraci\u00f3n, un atacante con nivel de administrador podr\u00eda ejecutar acciones fuera del alcance de seguridad previsto de la aplicaci\u00f3n, lo que resultar\u00eda en el control total del sistema operativo."}], "lastModified": "2026-09-30T18:17:54.723", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62CF7BF4-6AAA-443E-93B4-B2F080091C13", "versionEndExcluding": "2024"}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85F1764D-1DD8-44B0-BF5A-2420CB519A3C"}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.0.1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1FE1A0B-78D1-4626-A4CD-21B843DA596E"}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.0.2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CCAB888E-F030-4640-9A18-9E423E553308"}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C648B0A4-053C-4884-8A37-4AF03053ED1C"}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.1.1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "893EEA99-0096-4C9F-BA8A-246A3E3F6C15"}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.1.2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A1FDA3F3-DF79-4807-9451-F04B2DB9A2B6"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}