Nagios Fusion Stored Cross-Site Scripting Vulnerability in Email Settings Configuration

A stored cross-site scripting vulnerability has been identified in Nagios Fusion versions prior to 4.2.0. This issue arises when users add or configure email settings, as unsanitized input can be saved and later displayed in the administrative interface. This allows JavaScript to execute in the browsers of users who view the affected page. An attacker with the ability to modify SMTP or sendmail configuration fields could inject a malicious payload that executes in the context of other users' browsers.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected JavaScript is executed in the context of the user viewing the affected page.

Remediation

Users are advised to upgrade to Nagios Fusion version 4.2.0 or higher.