CVE-2013-10074 Nagios XI < 2012R2.6 XSS via Tools Menu
MediumCVSS 5.1
EPSS 0.42%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Nagios XI versions prior to 2012R2.6 are vulnerable to cross-site scripting (XSS) via the Tools Menu of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nagios XI | < 2012R2.6 | 2012R2.6 |
| nagios xi | < 2012 | 2012 |
| nagios xi | = 2012-r1.0 | No fix listed |
| nagios xi | = 2012-r1.1 | No fix listed |
| nagios xi | = 2012-r1.2 | No fix listed |
| nagios xi | = 2012-r1.3 | No fix listed |
| nagios xi | = 2012-r1.4 | No fix listed |
| nagios xi | = 2012-r1.5 | No fix listed |
| nagios xi | = 2012r1.6 | No fix listed |
| nagios xi | = 2012r1.7 | No fix listed |
| nagios xi | = 2012r1.8 | No fix listed |
| nagios xi | = 2012r1.9 | No fix listed |
| nagios xi | = 2012r2.0 | No fix listed |
| nagios xi | = 2012r2.1 | No fix listed |
| nagios xi | = 2012r2.2 | No fix listed |
| nagios xi | = 2012r2.3 | No fix listed |
| nagios xi | = 2012r2.4 | No fix listed |
| nagios xi | = 2012r2.4-b | No fix listed |
| nagios xi | = 2012r2.5 | No fix listed |
References
- www.nagios.com patch release-notes
- www.vulncheck.com third-party-advisory