Nagios XI Cross-Site Scripting and Cross-Site Request Forgery Vulnerability in Hypermap Replay Component

A vulnerability allowing cross-site scripting (XSS) and cross-site request forgery (CSRF) has been identified in Nagios XI versions prior to 5.11.3, specifically within the Hypermap Replay component. This issue arises because the component fails to properly validate or escape input, enabling the injection of malicious scripts that execute in the context of the user's browser. Furthermore, the component lacks adequate anti-CSRF protections for state-changing operations, which could lead to authenticated users being manipulated into performing unintended actions.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser, and cross-site request forgery, where users are tricked into performing actions they did not intend to.

Remediation

Users can upgrade to Nagios XI version 5.11.3 or later to address this vulnerability.