{
    "id": "CVE-2018-17148",
    "published": "2019-06-19 18:15:11",
    "last_modified": "2026-06-17 01:45:25",
    "cvss_score": "9.8",
    "cvss_severity": "CRITICAL",
    "cvss_version": "3.0",
    "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "cwe": "CWE-284",
    "description": "An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote attackers to gain access to configuration files containing confidential credentials.",
    "epss_score": "0.03682",
    "epss_percentile": "0.89396",
    "kev": 0,
    "kev_due": null,
    "has_exploit": 0,
    "updated_at": "2026-10-09 18:17:20",
    "priority": {
        "rank": 3,
        "label": "In your normal cycle",
        "why": "Critical by CVSS (9.8), but no sign of active exploitation."
    },
    "products": [
        {
            "vendor": "nagios",
            "product": "nagios_xi"
        }
    ],
    "kev_detail": null,
    "exploits": [],
    "refs_list": [
        "https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT",
        "https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT"
    ]
}