PT-2013-5935 · Nagios · Nagiosql

William Costa · Published 2013-12-09 · Updated 2024-02-14 · CVE-2013-6039

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions NagiosQL version 3.2 SP2

Description The issue is related to multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the txtSearch parameter to various pages, including 'admin/hostdependencies.php' and 'admin/hosts.php', which utilize the search functionality in 'functions/content class.php'.

Recommendations For NagiosQL version 3.2 SP2, consider restricting access to the search functionality in 'functions/content class.php' until a patch is available. Avoid using the txtSearch parameter in affected API endpoints, such as 'admin/hostdependencies.php' and 'admin/hosts.php', to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-6039

Affected Products

Nagiosql

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2013-6039 · Security Note
• http://osvdb.org/100612 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2013-12/0031.html · Note
• http://nagiosql.org/forum8/solved-issues/3270-security-hotfix-for-nagiosql-3-2-sp2.html · Note
• http://secunia.com/advisories/55896 · Note
• http://jvn.jp/cert/JVNVU92648323/index.html · Note
• http://kb.cert.org/vuls/id/268662 · Note