Nagios XI Cross-Site Scripting Vulnerability in Missing Page Component

A cross-site scripting (XSS) vulnerability exists in Nagios XI versions prior to 2024R1.1. The issue arises in the 'page-missing.php' component, which does not properly validate or escape user-supplied input. This flaw allows an attacker to create a malicious link that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser within the Nagios XI domain. The vulnerability is triggered when a user follows a link from an external site to a 'missing page' (404) on Nagios XI.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can execute malicious scripts in the context of the user's browser session.

Remediation

Users are advised to upgrade to Nagios XI version 2024R1.1 or later.