Cross-Site Scripting Vulnerability in Nagios XI by Nagios
CVE-2023-40932

5.4MEDIUM

Key Information:

Vendor

Nagios

Status
Nagios Xi
Vendor
CVE Published:
19 September 2023

What is CVE-2023-40932?

A Cross-Site Scripting vulnerability exists in Nagios XI, specifically in versions 5.11.1 and earlier, due to improper validation in the custom logo component. Authenticated attackers can exploit this flaw by injecting arbitrary JavaScript or HTML into the alt-text field, which can affect all pages that include the navbar, including the login page. This allows attackers to potentially capture plaintext credentials from unsuspecting users, posing significant security risks.

References

http://nagios.com
https://www.nagios.com/products/security/
https://outpost24.com/blog/nagios-xi-vulnerabilities/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.