Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Nagios XI < 2009R1.3 Multiple Vulnerabilities

Medium

Synopsis

A vulnerable version of Nagios XI has been detected.

Description

Versions of Nagios XI prior to 2009R1.3 are affected by multiple vulnerabilities:

- Nagios XI is affected by multiple cross-site scripting vulnerabilities due to its failure to properly sanitize user-supplied input to the 'login.php' script. A remote attacker could exploit these vulnerabilities by tricking a user into requesting a maliciously crafted URL, causing script code to be run in the user's browser in the context of the affected site.

- Nagios XI is affected by an SQL injection vulnerability due to its failure to properly sanitize user-supplied data to the 'record' parameter of the 'admin/users.php' script before using it in an SQL query. Successful exploitation of this vulnerability would allow the attacker to access and modify data and compromise the application. Note that the attacker must be authenticated to exploit this vulnerability.

Solution

Upgrade to Nagios XI 2009R1.3 or later.