In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformatting/editing of emails from an official email address.
References
Link | Resource |
---|---|
https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT | Release Notes Vendor Advisory |
https://github.com/4LPH4-NL/CVEs | Third Party Advisory |
https://github.com/sT0wn-nl/CVEs/blob/master/README.md#nagios-xi | Third Party Advisory |
https://www.nagios.com/downloads/nagios-xi/change-log/ | Release Notes Vendor Advisory |
Configurations
History
08 Aug 2023, 14:22
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-79 |
08 Jul 2022, 12:59
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 6.5 |
References | (MISC) https://www.nagios.com/downloads/nagios-xi/change-log/ - Release Notes, Vendor Advisory | |
References | (MISC) https://github.com/sT0wn-nl/CVEs/blob/master/README.md#nagios-xi - Third Party Advisory | |
References | (MISC) https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT - Release Notes, Vendor Advisory | |
References | (MISC) https://github.com/4LPH4-NL/CVEs - Third Party Advisory | |
First Time |
Nagios nagios Xi
Nagios |
|
CWE | CWE-74 | |
CPE | cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:* |
29 Jun 2022, 01:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-06-29 01:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-29269
Mitre link : CVE-2022-29269
CVE.ORG link : CVE-2022-29269
JSON object : View
Products Affected
nagios
- nagios_xi
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')