CVE-2014-4907

PNP4Nagios <0.6.22 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message.

References (8)

[Patch] http://docs.pnp4nagios.org/pnp-0.6/dwnld

[Third Party Advisory] http://secunia.com/advisories/59535

[Third Party Advisory] http://secunia.com/advisories/59603

[Exploit, Patch] http://sourceforge.net/p/pnp4nagios/code/ci/f846a6c9d007ca2bee05359af747619151195fc9

[Vendor Advisory] http://www.op5.com/blog/news/op5-monitor-6-3-1-release-notes

[Various Sources] https://bugs.op5.com/view.php?id=8761

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/68350

[Mailing List] http://openwall.com/lists/oss-security/2014/07/11/3

Scores

EPSS 0.0043

EPSS Percentile 62.3%

Details

CWE

CWE-79

Status published

Products (22)

op5/monitor

pnp4nagios/pnp4nagios < 0.6.21

pnp4nagios/pnp4nagios

pnp4nagios/pnp4nagios

pnp4nagios/pnp4nagios

pnp4nagios/pnp4nagios

pnp4nagios/pnp4nagios

pnp4nagios/pnp4nagios

pnp4nagios/pnp4nagios

pnp4nagios/pnp4nagios

... and 12 more

Published Jul 11, 2014

Tracked Since Feb 18, 2026