Nagios XI < 2009R1.3 Multiple Vulnerabilities

low Nessus Network Monitor Plugin ID 8370

Synopsis

A vulnerable version of Nagios XI has been detected.

Description

Versions of Nagios XI prior to 2009R1.3 are affected by multiple vulnerabilities:

- Nagios XI is affected by multiple cross-site scripting vulnerabilities due to its failure to properly sanitize user-supplied input to the 'login.php' script. A remote attacker could exploit these vulnerabilities by tricking a user into requesting a maliciously crafted URL, causing script code to be run in the user's browser in the context of the affected site.

- Nagios XI is affected by an SQL injection vulnerability due to its failure to properly sanitize user-supplied data to the 'record' parameter of the 'admin/users.php' script before using it in an SQL query. Successful exploitation of this vulnerability would allow the attacker to access and modify data and compromise the application. Note that the attacker must be authenticated to exploit this vulnerability.

Solution

Upgrade to Nagios XI 2009R1.3 or later.

See Also

http://assets.nagios.com/downloads/nagiosxi/CHANGES-2009.TXT

Plugin Details

Severity: Low

ID: 8370

Family: CGI

Published: 8/27/2014

Updated: 3/6/2019

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.5

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:nagios:nagios_xi

Patch Publication Date: 8/18/2010

Vulnerability Publication Date: 8/13/2010

Reference Information

BID: 42661, 42604