CVE-2023-40932

MEDIUM

Nagios XI < 5.11.2 - Authenticated Stored Cross-Site Scripting via Custom Logo Alt-Text Field

Title source: llm

Description

A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means the attacker is able to to steal plaintext credentials.

References (3)

Core 3

Core References

Product

http://nagios.com

Third Party Advisory

https://outpost24.com/blog/nagios-xi-vulnerabilities/

Vendor Advisory

https://www.nagios.com/products/security/

Scores

CVSS v3 5.4

EPSS 0.0264

EPSS Percentile 85.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

nagios/nagios_xi < 5.11.2

Published Sep 19, 2023

Tracked Since Feb 18, 2026