PT-2025-44488 · Nagios Enterprises · Nagios Fusion

Tisha Manandhar · Published 2025-10-30 · Updated 2025-10-30 · CVE-2023-53690

Positive Technologies · (AI Summary)

CVSS v2.0

8.5

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Nagios Fusion versions prior to 4.2.0

Description Nagios Fusion versions prior to 4.2.0 have a stored cross-site scripting (XSS) issue in the LDAP/AD authentication-server configuration. User input that is not properly sanitized can be stored and then displayed in the administrative user interface, which can lead to the execution of JavaScript in the browsers of users who view the affected page. An attacker who can add authentication servers using LDAP/AD integration could persist a malicious payload that runs in the context of other users’ browsers.

Recommendations Update Nagios Fusion to version 4.2.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-15968

CVE-2023-53690

Affected Products

Nagios Fusion

References · 7

• https://nagios.com/products/security/#fusion · Patch, Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15968 · Security Note
• https://nagios.com/changelog/nagios-fusion · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-53690 · Security Note
• https://twitter.com/CVEnew/status/1984012727921090903 · Twitter Post
• https://vulncheck.com/advisories/nagios-fusion-ldap-ad-integration-stored-xss · Note
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44488 · Note