CyberRota Analysis
AI-GeneratedThe Linuxfabrik monitoring-plugins for Icinga and Nagios are vulnerable in versions 6.0.0 and earlier, where the redfish-* plugins improperly construct request URLs by combining user-supplied base URLs with response-supplied links. This flaw allows a malicious or compromised Baseboard Management Controller (BMC) to redirect authenticated Redfish requests, potentially disclosing sensitive authentication tokens and credentials. Organizations utilizing these monitoring systems should prioritize patching or mitigating this vulnerability to protect against unauthorized access and credential leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish-* plugins built request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, allowing a malicious or compromised BMC to redirect authenticated Redfish requests and disclose X-Auth-Token or HTTP Basic credentials.