Nagios Xi vulnerabilities

CVE-2024-54961 [MEDIUM] CWE-200 CVE-2024-54961: Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the usernames and email addresses of all current users.

CVE-2011-10035 [HIGH] CWE-367 CVE-2011-10035: Nagios XI versions prior to 2011R1.9 contain privilege escalation vulnerabilities in the scripts tha Nagios XI versions prior to 2011R1.9 contain privilege escalation vulnerabilities in the scripts that install or update system crontab entries. Due to time-of-check/time-of-use race conditions and missing synchronization or final-path validation, a local low-privileged user could manipulate filesystem state during crontab installation to influence the

CVE-2020-10820 [MEDIUM] CWE-79 CVE-2020-10820: Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter. Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.

CVE-2024-14006 [MEDIUM] CWE-346 CVE-2024-14006: Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The applicatio Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of cr

CVE-2021-37351 [MEDIUM] CWE-276 CVE-2021-37351: Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated user Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to the server.

CVE-2021-37352 [MEDIUM] CWE-601 CVE-2021-37352: An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. To exploit the vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link.

CVE-2020-36862 [MEDIUM] CWE-79 CVE-2020-36862: Nagios XI versions prior to 5.6.11 contain unauthenticated vulnerabilities in the Highcharts local e Nagios XI versions prior to 5.6.11 contain unauthenticated vulnerabilities in the Highcharts local exporting tool. Crafted export requests could (1) inject script into exported/returned content due to insufficient output encoding (XSS), and (2) cause the server to fetch attacker-specified URLs (SSRF), potentially accessing internal network resources.

CVE-2021-33179 [MEDIUM] CWE-79 CVE-2021-33179: The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated refle The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. An authenticated victim, who accesses a specially crafted malicious URL, would unknowingly execute the attached payload.

CVE-2020-5790 [MEDIUM] CWE-352 CVE-2020-5790: Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive applicat Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.

CVE-2018-15713 [MEDIUM] CWE-79 CVE-2018-15713: Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the s Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php.

CVE-2018-15714 [MEDIUM] CWE-79 CVE-2018-15714: Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters.

CVE-2024-54957 [MEDIUM] CWE-601 CVE-2024-54957: Nagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by users Nagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by users with read-only permissions. This vulnerability allows an attacker to craft a malicious link that redirects users to an arbitrary external URL without their consent.

CVE-2024-14002 [MEDIUM] CWE-98 CVE-2024-14002: Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its Na Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An authenticated user can supply crafted path values that cause the server to include local files, potentially exposing sensitive information from the underlying host.

CVE-2020-23992 [MEDIUM] CWE-79 CVE-2020-23992: Cross Site Scripting (XSS) in Nagios XI 5.7.1 allows remote attackers to run arbitrary code via retu Cross Site Scripting (XSS) in Nagios XI 5.7.1 allows remote attackers to run arbitrary code via returnUrl parameter in a crafted GET request.

CVE-2024-13993 [MEDIUM] CWE-79 CVE-2024-13993: Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) vi Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) via the login page when accessed with older web browsers. Insufficient validation or escaping of user-supplied input reflected by the login page can allow an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript

CVE-2013-10071 [MEDIUM] CWE-79 CVE-2013-10071: Nagios XI versions prior to 2012R1.6 contain a reflected cross-site scripting (XSS) vulnerability in Nagios XI versions prior to 2012R1.6 contain a reflected cross-site scripting (XSS) vulnerability in the dashboard dashlet AJAX load functionality. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVE-2021-47694 [MEDIUM] CWE-79 CVE-2021-47694: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.4 / Nagios XI 5.8.6 contains a The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.4 / Nagios XI 5.8.6 contains a reflected cross-site scripting (XSS) vulnerability via the Test Command functionality. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVE-2011-10037 [MEDIUM] CWE-79 CVE-2011-10037: Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling o Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling of xiwindow variables used to build permalinks in the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVE-2024-13992 [MEDIUM] CWE-79 CVE-2024-13992: Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user vis Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the "missing page" (404) page after following a link from another website. The vulnerable component, page-missing.php, fails to properly validate or escape user-supplied input, allowing an attacker to craft a malicious link that, when visited by a

CVE-2023-7316 [MEDIUM] CWE-79 CVE-2023-7316: Nagios XI versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Graph Explor Nagios XI versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.