Cross-site scripting in Nagios XI - CVE-2018-15714
Published: November 14, 2018 / Updated: August 8, 2020
Vulnerability identifier: #VU36402
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2018-15714
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters.
Affected software
Nagios XI
How to mitigate CVE-2018-15714
Install update from vendor's website.