CVE-2023-40932 - A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field

Back Back to CVE browser

MEDIUM

A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field

Published Sep 19, 2023

5.4

MEDIUM

CVSS 3.1

EPSS 0.86%

Description

A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means the attacker is able to to steal plaintext credentials.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-45471
Advisory
https://outpost24.com/blog/nagios-xi-vulnerabilities/
Third Party Advisory
https://www.nagios.com/products/security/
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-45471		Advisory
https://outpost24.com/blog/nagios-xi-vulnerabilities/		Third Party Advisory
https://www.nagios.com/products/security/		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Sep 19, 2023

Updated Jul 9, 2026

Reserved Aug 22, 2023

Link CVE-2023-40932

CISA Vulnrichment

Updated Sep 24, 2024

NVD

Status Modified

Modified Jul 9, 2026

Link CVE-2023-40932

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Sep 19, 2023

Updated Jul 9, 2026

Link EUVD-2023-45471

GitHub

No data