PT-2019-16098 · Nagios · Nagios Xi

Code16 · Published 2019-12-30 · Updated 2020-01-03 · CVE-2019-20139

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nagios XI version 5.6.9

Description The issue exists due to a cross-site scripting (XSS) flaw. This flaw can be exploited via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can potentially attack the admin user.

Recommendations For Nagios XI version 5.6.9, consider restricting access to the nocscreenapi.php and schedulereport.php scripts until a patch is available. As a temporary workaround, avoid using the host, hostgroup, servicegroup, hour, or frequency parameters in the affected scripts to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-20139

Affected Products

Nagios Xi

References · 3

• 🔥 https://code610.blogspot.com/2019/12/multiple-xss-bugs-in-nagios-569.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-20139 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20139 · Vendor Advisory