PT-2025-44468 · Nagios Enterprises · Nagios Xi

Published 2025-10-30 · Updated 2025-10-30 · CVE-2020-36862

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.6.11

Description Nagios XI versions prior to 5.6.11 have unauthenticated issues in the Highcharts local exporting tool. Specifically, crafted export requests can lead to insufficient output encoding, resulting in cross-site scripting (XSS). This allows for the injection of script into exported content, which can then be executed in a user’s browser when viewed. Additionally, these requests can cause the server to fetch URLs specified by an attacker, potentially leading to server-side request forgery (SSRF) and the disclosure of sensitive information accessible from the export server.

Recommendations Update to version 5.6.11 or later.

Fix

SSRF

XSS

Weakness Enumeration

CWE-918

CWE-79

Related Identifiers

BDU:2025-14520

CVE-2020-36862

Affected Products

Nagios Xi

References · 8

• https://bdu.fstec.ru/vul/2025-14520 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36862 · Security Note
• https://nagios.com/changelog/nagios-xi · Patch
• https://osv.dev/vulnerability/CVE-2020-36862 · Vendor Advisory
• https://twitter.com/CVEnew/status/1984030159998218614 · Twitter Post
• https://nagios.com/products/security/#nagios-xi · Note
• https://vulncheck.com/advisories/nagios-xi-unauthenticated-xss-and-ssrf-via-highcharts · Note
• https://vulncheck.com/advisories/nagios-xi-authenticated-sqli-via-snmp-trap-interface-page · Note