Nagios Fusion Stored Cross-Site Scripting Vulnerability in LDAP/AD Integration

A stored cross-site scripting vulnerability has been identified in Nagios Fusion versions prior to 4.2.0, specifically within the LDAP/AD authentication server configuration. This vulnerability allows unsanitized user input to be stored and later rendered in the administrative user interface, executing JavaScript in the browsers of users who view the affected page. An attacker with the ability to add authentication servers through LDAP/AD integration could inject a malicious payload that executes in the context of other users' browsers.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected JavaScript is executed in the context of the user viewing the affected page.

Remediation

Users are advised to upgrade to Nagios Fusion version 4.2.0 or higher.