CVE-2023-40932
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary JavaScript or HTML via the alt-text field. This affects all pages containing the navbar including the login page, enabling the attacker to steal plaintext credentials.
Risk Assessment
The organization is at risk of credential theft in plaintext and potential takeover of administrative accounts, which could lead to full compromise of the monitoring system.
Recommendation
Immediately upgrade Nagios XI to version 5.11.2 or later, which includes a fix for the XSS vulnerability in the custom logo component.
Other vulnerabilities in Nagios XI
See all- CVE-2023-40931Medium
A SQL injection vulnerability in Nagios XI versions 5.11.0 through 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in a POST request to /nagiosxi/admin/banner_message-ajaxhelper.php.
- CVE-2021-25299Medium
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS) in /usr/local/nagiosxi/html/admin/sshterm.php due to improper input sanitization. A crafted URL can steal admin session cookies or be chained with other bugs for one-click RCE.
- CVE-2021-25298HighActively exploited
Nagios XI version xi-5.7.5 is affected by OS command injection due to improper sanitization of authenticated user input in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php.
- CVE-2021-25297HighActively exploited
A vulnerability in Nagios XI version xi-5.7.5 allows OS command injection. The issue exists in the switch.inc.php file due to improper sanitization of authenticated user input.
- CVE-2021-25296HighActively exploited
Nagios XI version xi-5.7.5 is affected by OS command injection in the file windowswmi.inc.php due to improper sanitization of authenticated user input. This allows execution of arbitrary commands on the server.
- CVE-2019-15949HighActively exploited
Nagios XI before 5.6.6 allows remote command execution as root. Exploitation requires access to the server as the nagios user or as the admin user via the web interface; the getprofile.sh script is executed as root via a passwordless sudo entry and runs check_plugin, which is owned by the nagios user.
- CVE-2023-24035Low
An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses an insecure timing comparison that leads to an attacker being able to bruteforce the admin password by measuring timing differences in the comparison.
- CVE-2023-24034Low
An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using an open redirect vulnerability.
- CVE-2023-7314Medium
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bandwidth Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- CVE-2023-7313Medium
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bulk Modifications tool. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
Original NVD description (English source)
A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means the attacker is able to to steal plaintext credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS