Nagios XI < 2009R1.3 Multiple Vulnerabilities

Medium Nessus Network Monitor Plugin ID 8370

Synopsis

A vulnerable version of Nagios XI has been detected.

Description

Versions of Nagios XI prior to 2009R1.3 are affected by multiple vulnerabilities:

- Nagios XI is affected by multiple cross-site scripting vulnerabilities due to its failure to properly sanitize user-supplied input to the 'login.php' script. A remote attacker could exploit these vulnerabilities by tricking a user into requesting a maliciously crafted URL, causing script code to be run in the user's browser in the context of the affected site.

- Nagios XI is affected by an SQL injection vulnerability due to its failure to properly sanitize user-supplied data to the 'record' parameter of the 'admin/users.php' script before using it in an SQL query. Successful exploitation of this vulnerability would allow the attacker to access and modify data and compromise the application. Note that the attacker must be authenticated to exploit this vulnerability.

Solution

Upgrade to Nagios XI 2009R1.3 or later.

See Also

http://assets.nagios.com/downloads/nagiosxi/CHANGES-2009.TXT

Plugin Details

Severity: Medium

ID: 8370

Family: CGI

Published: 2014/08/27

Modified: 2018/09/16

Dependencies: 3558

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 4.3

Temporal Score: 3.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 5.3

Temporal Score: 4.9

Vector: CVSS3#AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:nagios:nagios_xi

Patch Publication Date: 2010/08/18

Vulnerability Publication Date: 2010/08/13

Reference Information

BID: 42661, 42604