PT-2025-2637 · Nagios Xi · Nagios Xi

Published 2025-01-09 · Updated 2025-01-10 · CVE-2024-42898

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nagios XI version 2024R1.1.4

Description A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Account Settings page. This enables attackers to potentially manipulate user sessions or steal sensitive information.

Recommendations For Nagios XI version 2024R1.1.4, as a temporary workaround, consider restricting access to the Account Settings page until a patch is available. Avoid using the Name parameter in the affected page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-42898

Affected Products

Nagios Xi

References · 6

• 🔥 https://github.com/simalamuel/Research/tree/main/CVE-2024-42898 · Exploit
• https://nagios.com/products/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42898 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42898 · Security Note
• https://t.me/cvedetector/14906 · Telegram Post
• https://twitter.com/CVEnew/status/1877620705346597018 · Twitter Post