PT-2018-14377 · Nagios+1 · Nagios Core+1

Maximilian Boehner · Published 2018-12-17 · Updated 2024-06-15 · CVE-2018-18245

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nagios Core version 4.4.2

Description The issue concerns an XSS flaw in the alert summary reports of plugin results. This can be demonstrated by a SCRIPT element delivered by a modified check load plugin to NRPE, allowing for potential exploitation.

Recommendations For Nagios Core version 4.4.2, update to a version that includes a fix for this issue to prevent XSS attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-18245

DLA-1615-1

MGASA-2019-0104

OPENSUSE-SU-2020:0500-1

OPENSUSE-SU-2020:0517-1

OPENSUSE-SU-2020_0500-1

OPENSUSE-SU-2024:11073-1

Affected Products

Nagios Core

Suse

References · 43

• 🔥 https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180026.txt · Exploit
• https://ubuntu.com/security/CVE-2018-18245 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0500-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00014.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-18245 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18245 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-18245 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-18245 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00022.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0104.html · Security Note
• https://osv.dev/vulnerability/MGASA-2019-0104 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11073-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/3EGOZ3JA6TL3YUZ3XWYQ47OYQAJTWOTL · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-18245 · Security Note
• https://osv.dev/vulnerability/DLA-1615-1 · Vendor Advisory