CVE-2023-40932

—

CVSS 3.1

5.4 medium

EPSS

<1%p59

Published

Sep 19, 2023 (Sep 19, 2023)

Modified

Jul 9, 2026

Description

A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means the attacker is able to to steal plaintext credentials.

Vendors: nagios
Products: nagios xi
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news2 stories

Experts found flaws in Nagios XI network monitoring software

Security AffairsSep 20, 19:38 UTC · Sep 20, 2023Vulnerability CVE-2023-40931 CVE-2023-40932 CVE-2023-40933+1 CVEs

Critical Security Flaws Exposed in Nagios XI Network Monitoring Software

The Hacker NewsSep 20, 12:38 UTC · Sep 20, 2023Vulnerability CVE-2023-40931 CVE-2023-40934 CVE-2023-40933+1 CVEs