Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary HTML, aka XSS.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html | Third Party Advisory VDB Entry |
| https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ | Exploit Third Party Advisory |
| https://www.nagios.com/downloads/nagios-xi/change-log/ | Release Notes Vendor Advisory |
| http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html | Third Party Advisory VDB Entry |
| https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ | Exploit Third Party Advisory |
| https://www.nagios.com/downloads/nagios-xi/change-log/ | Release Notes Vendor Advisory |
Configurations
History
21 Nov 2024, 05:23
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html - Third Party Advisory, VDB Entry | |
| References | () https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ - Exploit, Third Party Advisory | |
| References | () https://www.nagios.com/downloads/nagios-xi/change-log/ - Release Notes, Vendor Advisory |
Information
Published : 2021-05-24 13:15
Updated : 2024-11-21 05:23
NVD link : CVE-2020-28903
Mitre link : CVE-2020-28903
CVE.ORG link : CVE-2020-28903
JSON object : View
Products Affected
nagios
- fusion
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')