« Volver al listado

CVE-2021-33178

Estado: ModificadaMedia (6.5)—

The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of this results in a malicious actor having the ability to arbitrarily delete files on the local system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Nagvis — Nagvis

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-33178",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 8.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 9.2,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@synopsys.com",
      "affectedData": [
        {
          "vendor": "NagVis",
          "product": "NagVis",
          "versions": [
            {
              "status": "affected",
              "version": "<1.9.29"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-10-14T15:15:09.040",
  "references": [
    {
      "url": "https://nagvis.org/downloads/changelog/1.9.29",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "disclosure@synopsys.com"
    },
    {
      "url": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-nagios-xi",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "disclosure@synopsys.com"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00000.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://nagvis.org/downloads/changelog/1.9.29",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-nagios-xi",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@synopsys.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of this results in a malicious actor having the ability to arbitrarily delete files on the local system."
    },
    {
      "lang": "es",
      "value": "La funcionalidad de gestión de fondos en las versiones de NagVis anteriores a la versiión 1.9.29 es vulnerable a una vulnerabilidad de cruce de ruta autenticada. La explotación de esta vulnerabilidad hace que un actor malintencionado tenga la capacidad de eliminar arbitrariamente archivos en el sistema local"
    }
  ],
  "lastModified": "2026-06-17T03:54:18.647",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nagvis:nagvis:*:*:*:*:*:nagios_xi:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A8270EC-0D33-455E-B365-0218C2958F90",
              "versionEndExcluding": "1.9.29"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "disclosure@synopsys.com"
}