CVE-2012-10063

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2012-10063", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2025-10-28T20:51:25.373Z", "datePublished": "2025-10-30T21:31:21.797Z", "dateUpdated": "2025-11-24T20:28:50.030Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Legacy Core Configuration Manager (CCM)"], "product": "XI", "vendor": "Nagios", "versions": [{"lessThan": "2012R1.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:nagios:nagios_xi:2012:*:*:*:*:*:*:*", "versionEndExcluding": "r1.3"}]}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Nagios XI versions prior to&nbsp;2012R1.3 contain&nbsp;a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowing access to configuration data stored in the application database.&nbsp;Successful exploitation could disclose or modify notification data and, in some cases, impact the application database more broadly.<br>"}], "value": "Nagios XI versions prior to\u00a02012R1.3 contain\u00a0a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowing access to configuration data stored in the application database.\u00a0Successful exploitation could disclose or modify notification data and, in some cases, impact the application database more broadly."}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2025-11-17T18:21:37.182Z"}, "references": [{"tags": ["release-notes", "patch"], "url": "https://www.nagios.com/changelog/nagios-xi/"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/nagios-xi-authenticated-sqli-in-legacy-ccm"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Nagios addresses this vulnerability as \"Fixed potential SQL injection vulnerability in legacy CCM for authenticated users.\"<br>"}], "value": "Nagios addresses this vulnerability as \"Fixed potential SQL injection vulnerability in legacy CCM for authenticated users.\""}], "source": {"discovery": "UNKNOWN"}, "title": "Nagios XI < 2012R1.3 Authenticated SQL Injection in Legacy CCM", "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-24T20:28:45.405708Z", "id": "CVE-2012-10063", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-24T20:28:50.030Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2012-10063", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-24T20:28:45.405708Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-31T17:43:36.338Z"}}], "cna": {"title": "Nagios XI < 2012R1.3 Authenticated SQL Injection in Legacy CCM", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Nagios", "modules": ["Legacy Core Configuration Manager (CCM)"], "product": "XI", "versions": [{"status": "affected", "version": "0", "lessThan": "2012R1.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Nagios addresses this vulnerability as \"Fixed potential SQL injection vulnerability in legacy CCM for authenticated users.\"", "supportingMedia": [{"type": "text/html", "value": "Nagios addresses this vulnerability as \"Fixed potential SQL injection vulnerability in legacy CCM for authenticated users.\"<br>", "base64": false}]}], "references": [{"url": "https://www.nagios.com/changelog/nagios-xi/", "tags": ["release-notes", "patch"]}, {"url": "https://www.vulncheck.com/advisories/nagios-xi-authenticated-sqli-in-legacy-ccm", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Nagios XI versions prior to\u00a02012R1.3 contain\u00a0a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowing access to configuration data stored in the application database.\u00a0Successful exploitation could disclose or modify notification data and, in some cases, impact the application database more broadly.", "supportingMedia": [{"type": "text/html", "value": "Nagios XI versions prior to&nbsp;2012R1.3 contain&nbsp;a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowing access to configuration data stored in the application database.&nbsp;Successful exploitation could disclose or modify notification data and, in some cases, impact the application database more broadly.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nagios:nagios_xi:2012:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "r1.3"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2025-11-17T18:21:37.182Z"}}}, "cveMetadata": {"cveId": "CVE-2012-10063", "state": "PUBLISHED", "dateUpdated": "2025-11-24T20:28:50.030Z", "dateReserved": "2025-10-28T20:51:25.373Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2025-10-30T21:31:21.797Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Legacy Core Configuration Manager (CCM)"], "product": "XI", "vendor": "Nagios", "versions": [{"lessThan": "2012R1.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*", "matchCriteriaId": "80293C30-1993-40B8-9495-6D0D9AA3E921", "versionEndIncluding": "2011", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012:r1.0:*:*:*:*:*:*", "matchCriteriaId": "63DC3A03-8CB1-489F-86D2-13F271C2C48D", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012:r1.1:*:*:*:*:*:*", "matchCriteriaId": "653ED130-C4EC-4EC1-AE81-99BA7F888B33", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012:r1.2:*:*:*:*:*:*", "matchCriteriaId": "B28B0CDB-0E18-4702-B498-C89431095C0D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nagios XI versions prior to\u00a02012R1.3 contain\u00a0a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowing access to configuration data stored in the application database.\u00a0Successful exploitation could disclose or modify notification data and, in some cases, impact the application database more broadly."}, {"lang": "es", "value": "Versiones de Nagios XI anteriores a 2012R1.3 contienen una vulnerabilidad de inyecci\u00f3n SQL en la interfaz del gestor de configuraci\u00f3n central (CCM) heredado. Usuarios autenticados podr\u00edan manipular consultas SQL al proporcionar entradas manipuladas a par\u00e1metros espec\u00edficos del CCM, lo que podr\u00eda permitir el acceso a datos de configuraci\u00f3n almacenados en la base de datos de la aplicaci\u00f3n. La explotaci\u00f3n exitosa podr\u00eda divulgar o modificar datos de notificaci\u00f3n y, en algunos casos, impactar la base de datos de la aplicaci\u00f3n de manera m\u00e1s amplia."}], "id": "CVE-2012-10063", "lastModified": "2026-10-18T00:10:00.123", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2012-10063", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-24T20:28:45.405708Z", "version": "2.0.3"}}]}, "published": "2025-10-30T22:15:35.913", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Release Notes"], "url": "https://www.nagios.com/changelog/nagios-xi/"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/nagios-xi-authenticated-sqli-in-legacy-ccm"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"created": "2025-10-31T10:13:29.616584+00:00", "updated": "2025-10-31T10:13:29.616622+00:00", "vendors": ["nagios", "nagios$PRODUCT$xi"]}