PT-2025-44621 · Nagios Enterprises · Nagios Xi

Adam Kues · Published 2025-10-31 · Updated 2025-10-31 · CVE-2024-13992

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.1

Description A cross-site scripting (XSS) issue exists in Nagios XI when a user visits the "missing page" (404) page after following a link from another website. The page-missing.php component does not properly validate or escape user-supplied input, which allows an attacker to create a malicious link. When a victim visits this link, arbitrary JavaScript code can be executed in the victim’s browser within the Nagios XI domain.

Recommendations Update to version 2024R1.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-13992

Affected Products

Nagios Xi

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-13992 · Security Note
• https://nagios.com/changelog/nagios-xi/2024r1-1 · Patch
• https://osv.dev/vulnerability/CVE-2024-13992 · Vendor Advisory
• https://t.me/CVEtracker/36300 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1984372724588773806 · Twitter Post
• https://vulncheck.com/advisories/nagios-xi-xss-via-missing-page · Note
• https://nagios.com/products/security/#nagios-xi · Patch, Vendor Advisory