CVE-2011-2179

Nagios 3.2.3-Icinga <1.4.1 - XSS

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an (a) command action or a (b) hosts action.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Stefan Schurtz · textremotemultiple

https://www.exploit-db.com/exploits/35818

View Code ZIP pw:eip

References (14)

[Third Party Advisory] http://archives.neohapsis.com/archives/bugtraq/2011-06/0017.html

[Exploit, Patch] http://archives.neohapsis.com/archives/bugtraq/2011-06/0018.html

[Third Party Advisory] http://secunia.com/advisories/44974

[Third Party Advisory] http://securityreason.com/securityalert/8274

[Exploit, Patch, Vendor Advisory] http://tracker.nagios.org/view.php?id=224

[Exploit, Patch] http://www.rul3z.de/advisories/SSCHADV2011-005.txt

[Exploit, Patch] http://www.rul3z.de/advisories/SSCHADV2011-006.txt

[Vendor Advisory] http://www.ubuntu.com/usn/USN-1151-1

[Issue Tracking] https://bugzilla.redhat.com/show_bug.cgi?id=709871

[Exploit, Patch, Vendor Advisory] https://dev.icinga.org/issues/1605

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/67797

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/48087

[Mailing List] http://www.openwall.com/lists/oss-security/2011/06/01/10

[Mailing List] http://www.openwall.com/lists/oss-security/2011/06/02/6

Scores

EPSS 0.3006

EPSS Percentile 96.6%

Classification

CWE

CWE-79

Status published

Affected Products (17)

icinga/icinga < 1.4.0

icinga/icinga

icinga/icinga

icinga/icinga

icinga/icinga

icinga/icinga

icinga/icinga

icinga/icinga

icinga/icinga

icinga/icinga

icinga/icinga

icinga/icinga

icinga/icinga

icinga/icinga

icinga/icinga

... and 2 more

Timeline

Published Jun 14, 2011

Tracked Since Feb 18, 2026