PT-2018-14377 · Nagios+1 · Nagios Core+1

Maximilian Boehner · Publicado 2018-12-17 · Atualizado 2024-06-15 · CVE-2018-18245

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nagios Core version 4.4.2

Description The issue concerns an XSS flaw in the alert summary reports of plugin results. This can be demonstrated by a SCRIPT element delivered by a modified check load plugin to NRPE, allowing for potential exploitation.

Recommendations For Nagios Core version 4.4.2, update to a version that includes a fix for this issue to prevent XSS attacks.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-18245

DLA-1615-1

MGASA-2019-0104

OPENSUSE-SU-2020:0500-1

OPENSUSE-SU-2020:0517-1

OPENSUSE-SU-2020_0500-1

OPENSUSE-SU-2024:11073-1

Produtos afetados

Nagios Core

Suse

Referências · 43

• 🔥 https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180026.txt · Exploit
• https://ubuntu.com/security/CVE-2018-18245 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2020-13977 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2020:0500-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-13458 · Nota
• https://suse.com/security/cve/CVE-2006-2162 · Nota
• https://suse.com/security/cve/CVE-2013-2214 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00014.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-18245 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18245 · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=24290 · Nota
• https://suse.com/security/cve/CVE-2018-13441 · Nota
• https://suse.com/security/cve/CVE-2016-8641 · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-18245 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-18245 · Nota