{"id":"CVE-2013-7108","url":"https://www.cyber-defence.io/tools/cve/CVE-2013-7108","generatedAt":"2026-11-05T07:17:08.497Z","title":"Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service…","description":"Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.","published":"2014-01-15T16:08:04.000Z","lastModified":"2026-06-17T00:01:26.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":5.5,"severity":"MEDIUM","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:P"},"cwe":["CWE-20"],"affected":["nagios/nagios","icinga/icinga"],"epss":{"score":0.61625,"percentile":0.99172,"date":"2026-11-04","history":[{"date":"2026-10-11","score":0.61625,"percentile":0.99154}]},"kev":{"listed":false},"exploits":{"count":1,"verified":true,"firstPublished":"2013-12-16","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":38882,"kind":"exploit","title":"Icinga - cgi/config.c process_cgivars Function Off-by-One Read Remote Denial of Service","url":"https://www.exploit-db.com/exploits/38882","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/cgi/dos/38882.txt","file":"exploits/cgi/dos/38882.txt","published":"2013-12-16","added":"2013-12-16","updated":"2015-12-06","author":"DTAG Group Information Security","type":"dos","platform":"cgi","port":null,"verified":true,"codes":["CVE-2013-7108","OSVDB-101337"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/64363/info"}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 61.6%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00010.html","source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00028.html","source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00046.html","source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00068.html","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/55976","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/56316","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/","source":"cve@mitre.org"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:004","source":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2013/12/24/1","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/64363","source":"cve@mitre.org"},{"url":"https://dev.icinga.org/issues/5251","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2018/12/msg00014.html","source":"cve@mitre.org"},{"url":"https://www.icinga.org/2013/12/17/icinga-security-releases-1-10-2-1-9-4-1-8-5/","source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00010.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00028.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00046.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00068.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/55976","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/56316","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:004","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2013/12/24/1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/64363","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://dev.icinga.org/issues/5251","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2018/12/msg00014.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.icinga.org/2013/12/17/icinga-security-releases-1-10-2-1-9-4-1-8-5/","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-7108","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}