CVE-2024-13993
⚪ Do wiadomości
Refleksywne XSS w Nagios XI umożliwia wykonanie złośliwego kodu w przeglądarkach.
CVSS
6.1
EPSS
0.8%
Exploit
none
Vendor
nagios
Opis źródłowy (NVD)
Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) via the login page when accessed with older web browsers. Insufficient validation or escaping of user-supplied input reflected by the login page can allow an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim’s browser within the Nagios XI origin. The issue is observable under legacy browser behaviors; modern browsers may mitigate some vectors.
xss
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 6.1 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.8% |
| Opublikowano (NVD) | 2025-10-30 22:15:44 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-02 00:10:00 UTC |
Referencje
- https://www.nagios.com/changelog/nagios-xi/ ([email protected]) [Release Notes]
- https://www.nagios.com/products/security/#nagios-xi ([email protected]) [Vendor Advisory]
- https://www.vulncheck.com/advisories/nagios-xi-reflected-xss-via-login-page-on-older-browsers ([email protected]) [Third Party Advisory]