CVE-2023-53689

MEDIUM

Nagios Fusion < 4.2.0 - Reflected Cross-Site Scripting in License Key Configuration

Title source: llm
STIX 2.1

Description

Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting (XSS) vulnerability in the license key configuration flow that can result in execution of attacker-controlled script in the browser of a user who follows a crafted URL. While the application server itself is not directly corrupted by the reflected XSS, the resulting browser compromise can lead to credential/session theft and unauthorized administrative actions.

References (3)

Core 3
Core References
Vendor Advisory vendor-advisory patch
https://www.nagios.com/products/security/#fusion
Release Notes release-notes patch
https://www.nagios.com/changelog/nagios-fusion/

Scores

CVSS v3 4.8
EPSS 0.0011
EPSS Percentile 29.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
nagios/fusion < 4.2.0
Published Oct 30, 2025
Tracked Since Feb 18, 2026