PT-2025-44496 · Nagios Enterprises · Nagios Xi

Published 2025-10-30 · Updated 2025-10-31 · CVE-2024-13993

Positive Technologies · (AI Summary)

CVSS v2.0

6.4

Medium

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.1.2

Description The software is susceptible to a reflected cross-site scripting (XSS) issue via the login page when accessed using older web browsers. Insufficient validation or escaping of user-supplied input reflected by the login page could allow an attacker to create a malicious link. When a victim clicks this link, it may execute arbitrary JavaScript within the victim’s browser, within the Nagios XI origin. The issue is more apparent in legacy browsers, while modern browsers may offer some protection.

Recommendations Update Nagios XI to version 2024R1.1.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-14703

CVE-2024-13993

Affected Products

Nagios Xi

References · 9

• https://nagios.com/changelog/nagios-xi · Patch
• https://osv.dev/vulnerability/CVE-2024-13993 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14703 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-13993 · Security Note
• https://nagios.com/products/security/#nagios-xi · Patch, Vendor Advisory
• https://vulncheck.com/advisories/nagios-xi-reflected-xss-via-login-page-on-older-browsers · Note
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44496 · Note
• https://twitter.com/CVEnew/status/1984015859262619971 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1984142319902220578 · Twitter Post