Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature     in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string     to cgi-bin/status.cgi. (CVE-2015-8010)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for icinga fixes the following issues :

Update to 1.14.0

  - CVE-2015-8010: Fixed XSS in the icinga classic UI     (boo#952777)

  - CVE-2016-8641 / CVE-2016-10089: fixed a possible symlink     attack for files/dirs created by root (boo#1011630 and     boo#1018047)

  - CVE-2016-0726: removed the pre-configured administrative     account with fixed password for the WebUI - (boo#961115)

This update for icinga includes various upstream fixes and the following security security fixes :

  - icinga was updated to version 1.14.0

  - the classic-UI was vulnerable to a cross site scripting     attack (CVE-2015-8010, boo#952777)

  - A user with nagios privileges could have gained root     privileges by placing a symbolic link at the logfile     location (CVE-2016-9566, boo#1014637)

ID	Name	Product	Family	Severity
264050	Linux Distros Unpatched Vulnerability : CVE-2015-8010	Nessus	Misc.	medium
118249	openSUSE Security Update : icinga (openSUSE-2018-1206)	Nessus	SuSE Local Security Checks	critical
96545	openSUSE Security Update : icinga (openSUSE-2017-100)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2015-8010

medium

Tenable Plugins

medium

critical

high