CVE-2023-40932
A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means the attacker is able to to steal plaintext credentials.
- Score
- CVSS 3.1 5.4 Medium
- Status
- Modified - cve@mitre.org
- Published
- 2023-09-19
- Last modified
- 2026-07-09
- Weaknesses
- CWE-79
Affected products
References
- https://outpost24.com/blog/nagios-xi-vulnerabilities/
- https://www.nagios.com/products/security/
