{"api_version":"1","generated_at":"2026-07-23T08:54:03+00:00","cve":"CVE-2018-16146","urls":{"html":"https://cve.report/CVE-2018-16146","api":"https://cve.report/api/cve/CVE-2018-16146.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-16146","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-16146"},"summary":{"title":"CVE-2018-16146","description":"The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated administrator to test notifications that are triggered under certain configurable events. The value parameter is not properly sanitized, leading to arbitrary command injection with the privileges of the nagios user account.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2018-09-05 21:29:00","updated_at":"2019-10-03 00:03:00"},"problem_types":["CWE-78"],"metrics":[],"references":[{"url":"https://seclists.org/fulldisclosure/2018/Sep/3","name":"20180904 [CORE-2018-0008] - Opsview Monitor Multiple Vulnerabilities","refsource":"FULLDISC","tags":["Exploit","Mailing List","Third Party Advisory"],"title":"Full Disclosure: [CORE-2018-0008] - Opsview Monitor Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.coresecurity.com/advisories/opsview-monitor-multiple-vulnerabilities","name":"https://www.coresecurity.com/advisories/opsview-monitor-multiple-vulnerabilities","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"Opsview Monitor Multiple Vulnerabilities | SecureAuth","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://knowledge.opsview.com/v5.4/docs/whats-new","name":"https://knowledge.opsview.com/v5.4/docs/whats-new","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"What's New?","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16146","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16146","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"16146","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"opsview","cpe5":"opsview","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"16146","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"opsview","cpe5":"opsview","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2018-16146","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated administrator to test notifications that are triggered under certain configurable events. The value parameter is not properly sanitized, leading to arbitrary command injection with the privileges of the nagios user account."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://knowledge.opsview.com/v5.4/docs/whats-new","refsource":"CONFIRM","url":"https://knowledge.opsview.com/v5.4/docs/whats-new"},{"name":"20180904 [CORE-2018-0008] - Opsview Monitor Multiple Vulnerabilities","refsource":"FULLDISC","url":"https://seclists.org/fulldisclosure/2018/Sep/3"},{"name":"https://www.coresecurity.com/advisories/opsview-monitor-multiple-vulnerabilities","refsource":"MISC","url":"https://www.coresecurity.com/advisories/opsview-monitor-multiple-vulnerabilities"}]}},"nvd":{"publishedDate":"2018-09-05 21:29:00","lastModifiedDate":"2019-10-03 00:03:00","problem_types":["CWE-78"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE","baseScore":9},"severity":"HIGH","exploitabilityScore":8,"impactScore":10,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:opsview:opsview:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.0","versionEndExcluding":"5.4.2","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"16146","Ordinal":"132935","Title":"CVE-2018-16146","CVE":"CVE-2018-16146","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"16146","Ordinal":"1","NoteData":"The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated administrator to test notifications that are triggered under certain configurable events. The value parameter is not properly sanitized, leading to arbitrary command injection with the privileges of the nagios user account.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"16146","Ordinal":"2","NoteData":"2018-09-05","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"16146","Ordinal":"3","NoteData":"2018-09-05","Type":"Other","Title":"Modified"}]}}}