CVE-2021-47698: Nagios XI < 5.8.7 XSS in Core UI Views URL handling

Q: What is the severity of CVE-2021-47698?

CVE-2021-47698 is classified as a critical vulnerability due to its potential for cross-site scripting (XSS) attacks.

Q: How do I fix CVE-2021-47698?

To fix CVE-2021-47698, upgrade Nagios XI to version 5.8.7 or later.

Q: What are the potential impacts of CVE-2021-47698?

CVE-2021-47698 may allow attackers to inject and execute arbitrary scripts, leading to unauthorized access and data manipulation.

Q: Which versions of Nagios XI are affected by CVE-2021-47698?

Nagios XI versions prior to 5.8.7 are vulnerable to CVE-2021-47698.

Q: What type of attack does CVE-2021-47698 facilitate?

CVE-2021-47698 facilitates cross-site scripting (XSS) attacks due to insufficient input validation.

Published Nov 3, 2025

Updated

Nagios XI versions prior to 5.8.7 using embedded Nagios Core are vulnerable to cross-site scripting (XSS) via the Core UI’s Views URL handling (escapestring()). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Affected Software

2 affected components

Nagios XI<5.8.7

Nagios Nagios XI<5.8.7

Remediation

Information

Nagios addresses this vulnerability as "Fixed XSS vulnerability in Nagios Core ui by patching Core for XI systems with escape_string()."

Event History

Nov 3, 2025

CVE Published

via MITRE·09:56 PM

Data Sourced

via MITRE·09:56 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Jan 16, 57822

Event

via NVD·06:08 AM

Frequently Asked Questions

What is the severity of CVE-2021-47698?

CVE-2021-47698 is classified as a critical vulnerability due to its potential for cross-site scripting (XSS) attacks.

How do I fix CVE-2021-47698?

To fix CVE-2021-47698, upgrade Nagios XI to version 5.8.7 or later.

What are the potential impacts of CVE-2021-47698?