Nagios Log Server Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Nagios Log Server versions prior to 2024R1. This issue allows an attacker to inject a username containing JavaScript, which is then stored and later displayed without proper encoding or escaping on admin or user-facing pages. When an authenticated user accesses the affected page, the injected script is executed in their browser context.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.

Remediation

Users are advised to upgrade to Nagios Log Server version 2024R1 or above.