PT-2025-44486 · Nagios Enterprises · Nagios Xi

Aleksey Solovev · Published 2025-10-30 · Updated 2025-10-30 · CVE-2023-53688

Positive Technologies · (AI Summary)

CVSS v3.1

5.4

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.11.3

Description The software is susceptible to cross-site scripting (XSS) and cross-site request forgery (CSRF) through the Hypermap Replay component. An attacker can submit crafted input that is not properly validated or escaped, leading to the injection of malicious script that executes within a victim’s browser (XSS). The component also lacks sufficient anti-CSRF protections on operations that change system state, potentially allowing an attacker to make authenticated users perform unintended actions.

Recommendations Update to version 5.11.3 or later.

Fix

CSRF

XSS

Weakness Enumeration

CWE-352

CWE-79

Related Identifiers

BDU:2025-14533

CVE-2023-53688

Affected Products

Nagios Xi

References · 7

• https://nagios.com/changelog/nagios-xi · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-53688 · Security Note
• https://nagios.com/products/security/#nagios-xi · Patch, Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14533 · Security Note
• https://twitter.com/CVEnew/status/1984030157318029511 · Twitter Post
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44486 · Note
• https://vulncheck.com/advisories/nagios-xi-xss-and-csrf-via-hypermap-relay · Note