PT-2025-44508 · Nagios · Nagios Log Server

Published 2025-10-30 · Updated 2025-10-31 · CVE-2024-58272

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nagios Log Server versions prior to 2024R1

Description The software contains a stored cross-site scripting (XSS) issue. An attacker can inject JavaScript code through a manipulated username that is stored and then displayed on admin or user-facing pages without proper encoding or escaping. When an authenticated user accesses the affected page, the injected script executes within their browser session.

Recommendations Update to Nagios Log Server version 2024R1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-58272

Affected Products

Nagios Log Server

References · 6

• https://nagios.com/changelog/#log-server-2024R1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-58272 · Security Note
• https://nagios.com/products/security/#log-server · Patch, Vendor Advisory
• https://vulncheck.com/advisories/nagios-log-server-stored-xss-via-username · Note
• https://twitter.com/CVEnew/status/1984012714394439759 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1984114161903710374 · Twitter Post