CVE-2024-14001: Nagios XI < 2024R1.1.3 XSS via Executive Summary Report
Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Executive Summary Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nagios XIto a version that resolves this vulnerability.Fixed in 2024R1.1.3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-14001?
CVE-2024-14001 is classified as a medium severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2024-14001?
To fix CVE-2024-14001, upgrade Nagios XI to version 2024R1.1.3 or later.
What components of Nagios XI are affected by CVE-2024-14001?
CVE-2024-14001 affects the Executive Summary Report component in Nagios XI.
What exploitation methods are possible with CVE-2024-14001?
An attacker can exploit CVE-2024-14001 by injecting and executing arbitrary scripts in a victim's browser.
Is user input validation adequate in versions prior to the fix for CVE-2024-14001?
No, user input validation in versions prior to the fix for CVE-2024-14001 is insufficient, allowing XSS vulnerabilities.