A stored cross-site scripting (XSS) vulnerability in the NOC component of Nagios XI version up to and including 2024R1 allows low-privileged users to execute malicious HTML or JavaScript code via the audio file upload functionality from the Operation Center section. This allows any authenticated user to execute arbitrary JavaScript code on behalf of other users, including the administrators.
References
| Link | Resource |
|---|---|
| https://www.nagios.com/products/security/#nagios-xi | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
09 Feb 2024, 19:45
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| References | () https://www.nagios.com/products/security/#nagios-xi - Vendor Advisory | |
| First Time |
Nagios
Nagios nagios Xi |
|
| CPE | cpe:2.3:a:nagios:nagios_xi:2024:r1:*:*:*:*:*:* cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:* |
02 Feb 2024, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-02 10:15
Updated : 2024-02-28 20:54
NVD link : CVE-2023-51072
Mitre link : CVE-2023-51072
CVE.ORG link : CVE-2023-51072
JSON object : View
Products Affected
nagios
- nagios_xi
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')