CVE-2011-10040 Nagios XI < 2011R1.9 XSS via Status/Report Page Link Functions
MediumCVSS 5.1
EPSS 0.44%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the link-handling functions used by status and report pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nagios XI | < 2011R1.9 | 2011R1.9 |
| nagios xi | <= 2009 | No fix listed |
| nagios xi | = 2011-r1 | No fix listed |
| nagios xi | = 2011-r1.1 | No fix listed |
| nagios xi | = 2011-r1.2 | No fix listed |
| nagios xi | = 2011-r1.3 | No fix listed |
| nagios xi | = 2011-r1.4 | No fix listed |
| nagios xi | = 2011-r1.5 | No fix listed |
| nagios xi | = 2011-r1.6 | No fix listed |
| nagios xi | = 2011-r1.7 | No fix listed |
| nagios xi | = 2011-r1.8 | No fix listed |
References
- www.nagios.com patch release-notes
- www.vulncheck.com third-party-advisory