PT-2023-3898 · Unknown · Pnp4Nagios

Published 2023-07-06 · Updated 2023-07-26 · CVE-2023-38350

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PNP4Nagios versions 0.6.26 through 81ebfc5

Description The issue is related to stored XSS in the AJAX controller via the basket API and filters. This can be exploited by a remote attacker to perform cross-site scripting attacks. The vulnerability is due to the lack of protection of the web page structure.

Recommendations For PNP4Nagios version 0.6.26, consider disabling the filter() and basket() functions in the Ajax Controller as a temporary workaround until a patch is available. For versions prior to the fixed version, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-04190

CVE-2023-38350

Affected Products

Pnp4Nagios

References · 11

• 🔥 https://github.com/pnp4nagios/pnp4nagios/pull/16 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-38350 · Security Note
• https://bdu.fstec.ru/vul/2023-04190 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38350 · Vendor Advisory
• https://github.com/pnp4nagios/pnp4nagios/pull/16/files · Note
• https://github.com/pnp4nagios/pnp4nagios/pull/16/commits/70b74b23da0d54daaec3ad42a0ea6bcb6c45f11d · Note
• https://t.me/cvenotify/55261 · Telegram Post
• https://t.me/cvenotify/54436 · Telegram Post
• https://github.com/advisories/GHSA-99c6-mjfj-w86j · Note
• https://sourceforge.net/projects/pnp4nagios · Note
• https://vuldb.com/ru/?id.234222 · Note