PT-2025-44489 · Nagios · Nagios Fusion

Tisha Manandhar · Publicado 2025-10-30 · Atualizado 2025-10-30 · CVE-2023-7312

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Nagios Fusion versions prior to 4.2.0

Description Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) issue when adding or configuring Email Settings. Insufficient input sanitization allows malicious code to be stored and executed in the browser of users viewing the affected page. An attacker could exploit this by modifying SMTP/email settings or manipulating sendmail configuration fields to inject and persist a malicious payload.

Recommendations Update to Nagios Fusion version 4.2.0 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2025-15970

CVE-2023-7312

Produtos afetados

Nagios Fusion

Referências · 8

• https://nagios.com/products/security/#fusion · Correção, Aviso do Fabricante
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44489 · Nota
• https://vulncheck.com/advisories/nagios-fusion-email-settings-stored-xss-via-smtp-sendmail · Nota
• https://osv.dev/vulnerability/CVE-2023-7312 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2025-15970 · Nota de Segurança
• https://nagios.com/changelog/nagios-fusion · Correção
• https://twitter.com/CVEnew/status/1984012728852213771 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-7312 · Nota de Segurança