| Package | Affected versions | Patched versions |
|---|---|---|
| nagios xi | = 2024< 2024 | 2024 |
Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) via the login page when accessed with older web browsers. Insufficient validation or escaping of user-supplied input reflected by the login page can allow an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim’s browser within the Nagios XI origin. The issue is observable under legacy browser behaviors; modern browsers may mitigate some vectors.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free