PT-2018-9959 · Nagios · Nagios Xi

Code16 · Publicado 2018-04-30 · Atualizado 2020-08-24 · CVE-2018-10554

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Nagios XI version 5.4.13

Description: An issue was discovered in Nagios XI, allowing for XSS exploitation via CSRF. This can occur through various means, including the Schedule New Report screen via the hour, minute, or ampm parameter, the update pages function in downtime.php, the opts or background parameter in ajaxhelper.php, the i[] array parameter to ajax handler.php, or the title parameter in deploynotification.php.

Recommendations: For Nagios XI version 5.4.13, consider disabling the Schedule New Report screen and restricting access to the downtime.php, ajaxhelper.php, ajax handler.php, and deploynotification.php files until a patch is available. Avoid using the hour, minute, ampm, opts, background, i[], and title parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

XSS

Enumeração de Fraquezas

CWE-352

CWE-79

Identificadores relacionados

CVE-2018-10554

Produtos afetados

Nagios Xi

Referências · 3

• 🔥 http://code610.blogspot.com/2018/04/few-bugs-in-latest-nagios-xi-5413.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-10554 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-10554 · Nota de Segurança