PT-2023-5504 · Nagios Xi · Nagios Xi

Astrid Tedenbrant · Published 2023-08-04 · Updated 2023-09-25 · CVE-2023-40932

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Nagios XI versions 5.11.1 and below

Description A Cross-site scripting (XSS) vulnerability in the Custom Logo component allows authenticated attackers to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar, including the login page, enabling the attacker to steal plaintext credentials. The vulnerability can be exploited by remote attackers.

Recommendations For Nagios XI versions 5.11.1 and below, consider disabling the Custom Logo component until a patch is available to prevent exploitation. Restrict access to the alt-text field in the Custom Logo component to minimize the risk of XSS attacks. As a temporary workaround, avoid using the Custom Logo component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-06150

CVE-2023-40932

Affected Products

Nagios Xi

References · 12

• https://nagios.com/products/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40932 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06150 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-40932 · Security Note
• https://outpost24.com/blog/nagios-xi-vulnerabilities · Note
• https://t.me/cvenotify/58145 · Telegram Post
• https://twitter.com/CVEnew/status/1704267438613786703 · Twitter Post
• https://twitter.com/zoomeye_team/status/1706260212062285958 · Twitter Post
• http://nagios.com · Note
• https://twitter.com/HunterMapping/status/1704850466243256784 · Twitter Post
• https://t.me/true_secator/4873 · Telegram Post
• https://twitter.com/CyberSec84/status/1704820639213752570 · Twitter Post