Nagios XI Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Nagios XI version 2024R2. This vulnerability allows remote attackers to execute arbitrary JavaScript in the context of a logged-in user's session by sending a specially crafted URL. The issue is present in a web component that renders performance-related data.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject and execute malicious scripts in the victim's browser, potentially leading to session hijacking or other malicious actions.

Reproduction

To reproduce this vulnerability, send a crafted URL to a user logged into Nagios XI 2024R2. The URL should include the malicious JavaScript payload. When the user clicks the link, the injected script will execute in their browser session.

Remediation

Users can upgrade to Nagios XI version 2024R2.1, where this vulnerability has been fixed.