A stored cross-site scripting (XSS) vulnerability in the NOC component of Nagios XI version up to and including 2024R1 allows low-privileged users to execute malicious HTML or JavaScript code via the audio file upload functionality from the Operation Center section. This allows any authenticated user to execute arbitrary JavaScript code on behalf of other users, including the administrators.
References
Link | Resource |
---|---|
https://www.nagios.com/products/security/#nagios-xi | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
09 Feb 2024, 19:45
Type | Values Removed | Values Added |
---|---|---|
References | () https://www.nagios.com/products/security/#nagios-xi - Vendor Advisory | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
CPE | cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:* cpe:2.3:a:nagios:nagios_xi:2024:r1:*:*:*:*:*:* |
|
CWE | CWE-79 | |
First Time |
Nagios nagios Xi
Nagios |
02 Feb 2024, 13:36
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
02 Feb 2024, 10:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-02-02 10:15
Updated : 2024-02-09 19:45
NVD link : CVE-2023-51072
Mitre link : CVE-2023-51072
CVE.ORG link : CVE-2023-51072
JSON object : View
Products Affected
nagios
- nagios_xi
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')