PT-2013-5935 · Nagios · Nagiosql

William Costa · Publicado 2013-12-09 · Atualizado 2024-02-14 · CVE-2013-6039

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions NagiosQL version 3.2 SP2

Description The issue is related to multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the txtSearch parameter to various pages, including 'admin/hostdependencies.php' and 'admin/hosts.php', which utilize the search functionality in 'functions/content class.php'.

Recommendations For NagiosQL version 3.2 SP2, consider restricting access to the search functionality in 'functions/content class.php' until a patch is available. Avoid using the txtSearch parameter in affected API endpoints, such as 'admin/hostdependencies.php' and 'admin/hosts.php', to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-6039

Produtos afetados

Nagiosql

Referências · 7

• http://osvdb.org/100612 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2013-12/0031.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6039 · Nota de Segurança
• http://nagiosql.org/forum8/solved-issues/3270-security-hotfix-for-nagiosql-3-2-sp2.html · Nota
• http://secunia.com/advisories/55896 · Nota
• http://jvn.jp/cert/JVNVU92648323/index.html · Nota
• http://kb.cert.org/vuls/id/268662 · Nota