CVE-2011-1523: XSS
Cross-site scripting (XSS) vulnerability in Nagios allows remote attackers to inject arbitrary web script or HTML via specially-crafted 'layer' parameter passed to the Nagios network status map CGI script (statusmap.cgi).
References: [1] http://tracker.nagios.org/view.php?id=207 [2] http://www.rul3z.de/advisories/SSCHADV2011-002.txt [3] http://secunia.com/advisories/43287/
Public PoC (from [2): ===================== http://site/nagios/cgi-bin/statusmap.cgi?layer=' onmouseover="alert('XSS')" '
Other sources
Cross-site scripting (XSS) vulnerability in statusmap.c in statusmap.cgi in Nagios 3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the layer parameter.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1523?
CVE-2011-1523 has a medium severity rating due to its potential for cross-site scripting attacks.
How do I fix CVE-2011-1523?
To fix CVE-2011-1523, upgrade to Nagios version 3.2.4 or later, which addresses the XSS vulnerability.
What type of vulnerability is CVE-2011-1523?
CVE-2011-1523 is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject malicious scripts.
Which versions of Nagios are affected by CVE-2011-1523?
CVE-2011-1523 affects Nagios versions up to and including 3.2.3, as well as various earlier versions.
Can CVE-2011-1523 lead to data theft?
Yes, if exploited, CVE-2011-1523 can allow attackers to steal sensitive information from users through malicious scripts.