PT-2025-44489 · Nagios · Nagios Fusion

Tisha Manandhar · Published 2025-10-30 · Updated 2025-10-30 · CVE-2023-7312

Positive Technologies · (AI Summary)

CVSS v2.0

8.5

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Nagios Fusion versions prior to 4.2.0

Description Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) issue when adding or configuring Email Settings. Insufficient input sanitization allows malicious code to be stored and executed in the browser of users viewing the affected page. An attacker could exploit this by modifying SMTP/email settings or manipulating sendmail configuration fields to inject and persist a malicious payload.

Recommendations Update to Nagios Fusion version 4.2.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-15970

CVE-2023-7312

Affected Products

Nagios Fusion

References · 7

• https://nagios.com/changelog/nagios-fusion · Patch
• https://nagios.com/products/security/#fusion · Patch, Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15970 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-7312 · Security Note
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44489 · Note
• https://vulncheck.com/advisories/nagios-fusion-email-settings-stored-xss-via-smtp-sendmail · Note
• https://twitter.com/CVEnew/status/1984012728852213771 · Twitter Post