PT-2019-16098 · Nagios · Nagios Xi

Code16 · Publicado 2019-12-30 · Atualizado 2020-01-03 · CVE-2019-20139

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nagios XI version 5.6.9

Description The issue exists due to a cross-site scripting (XSS) flaw. This flaw can be exploited via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can potentially attack the admin user.

Recommendations For Nagios XI version 5.6.9, consider restricting access to the nocscreenapi.php and schedulereport.php scripts until a patch is available. As a temporary workaround, avoid using the host, hostgroup, servicegroup, hour, or frequency parameters in the affected scripts to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-20139

Produtos afetados

Nagios Xi

Referências · 3

• 🔥 https://code610.blogspot.com/2019/12/multiple-xss-bugs-in-nagios-569.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-20139 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-20139 · Aviso do Fabricante