CVE-2024-13993: Nagios XI < 2024R1.1.2 Reflected XSS via Login Page on Older Browsers
Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) via the login page when accessed with older web browsers. Insufficient validation or escaping of user-supplied input reflected by the login page can allow an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim’s browser within the Nagios XI origin. The issue is observable under legacy browser behaviors; modern browsers may mitigate some vectors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nagios XIto a version that resolves this vulnerability.Fixed in 2024R1.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13993?
CVE-2024-13993 is considered to have a moderate severity due to the possibility of reflected cross-site scripting (XSS) attacks.
How do I fix CVE-2024-13993?
To fix CVE-2024-13993, upgrade Nagios XI to version 2024R1.1.2 or later.
Which versions of Nagios XI are affected by CVE-2024-13993?
Nagios XI versions prior to 2024R1.1.2 are vulnerable to CVE-2024-13993.
What type of vulnerability is CVE-2024-13993?
CVE-2024-13993 is a reflected cross-site scripting (XSS) vulnerability.
Can the CVE-2024-13993 vulnerability be exploited through the login page?
Yes, CVE-2024-13993 can be exploited via the login page when accessed with older web browsers.