Nagios Fusion Reflected Cross-Site Scripting Vulnerability in License Key Configuration

A reflected cross-site scripting vulnerability has been identified in Nagios Fusion versions prior to 4.2.0. This issue arises in the license key configuration process, allowing the execution of attacker-controlled scripts in the browser of users who click on a crafted URL. While the application server is not directly compromised, this reflected XSS can lead to theft of credentials or session information and unauthorized administrative actions.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute scripts in the context of the user's browser.

Remediation

Users are advised to upgrade to Nagios Fusion version 4.2.0 or higher.