{"id":"CVE-2021-3193","aliases":["EUVD-2021-26534","GHSA-9f3q-pwxj-87pv"],"status":"published","title":"Improper access and command validation in the Docker config wizard of Nagios XI before 5.8.0...","description":"Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.09887,"percentile":0.95609,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2021-01-22T03:56:03Z","modified":"2026-06-17T04:04:49Z","products":[{"vendor":"nagios","product":"nagios_xi"}],"references":[{"url":"https://www.nagios.com/products/security/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3193"},{"url":"https://github.com/advisories/GHSA-9f3q-pwxj-87pv"}],"sources":{"cve":[{"id":"CVE-2021-3193","description":"Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user.","status":"published","published":"2021-01-22T03:56:03Z","modified":"2024-08-03T16:45:51.395Z","updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-26534","description":"Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user.","status":"published","published":"2021-01-22T03:56:03Z","modified":"2024-08-03T16:45:51Z","updated_at":"2026-11-03T03:25:13.531128Z"}],"ghsa":[{"id":"GHSA-9f3q-pwxj-87pv","title":"Improper access and command validation in the Docker config wizard of Nagios XI before 5.8.0...","description":"Improper access and command validation in the Docker config wizard of Nagios XI before 5.8.0 allows an authenticated attacker to execute remote code as the apache user.","status":"published","published":"2022-05-24T17:40:23Z","modified":"2023-01-29T05:05:31Z","updated_at":"2026-11-02T14:45:48.864861Z"}],"nvd":[{"id":"CVE-2021-3193","description":"Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user.","status":"published","published":"2021-01-26T18:16:28.367Z","modified":"2026-06-17T04:04:49.393Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:06:49.660551Z"}]}}