CVE-2023-37154

Description

check_by_ssh in Nagios nagios-plugins 2.4.5 allows arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with \${IFS}. This has been categorized both as fixed in e8810de, and as intended behavior.

Reserved 2023-06-28 | Published 2024-10-09 | Updated 2024-10-09 | Assigner mitre

References

github.com/...ommit/e8810de21be80148562b7e0168b0a62aeedffde6

github.com/...lugins/security/advisories/GHSA-p3gv-vmpx-hhw4

joshua.hu/nagios-hacking-cve-2023-37154

cve.org (CVE-2023-37154)

nvd.nist.gov (CVE-2023-37154)

Download JSON