CVE-2023-51072
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A stored cross-site scripting (XSS) vulnerability in the NOC component of Nagios XI version up to and including 2024R1 allows low-privileged users to execute malicious HTML or JavaScript code via the audio file upload functionality from the Operation Center section. This allows any authenticated user to execute arbitrary JavaScript code on behalf of other users, including the administrators.
Una vulnerabilidad de cross-site scripting (XSS) almacenada en el componente NOC de la versión Nagios XI hasta 2024R1 inclusive permite a usuarios con pocos privilegios ejecutar código HTML o JavaScript malicioso a través de la funcionalidad de carga de archivos de audio desde la sección Operation Center. Esto permite que cualquier usuario autenticado ejecute código JavaScript arbitrario en nombre de otros usuarios, incluidos los administradores.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2023-12-18 CVE Reserved
- 2024-02-02 CVE Published
- 2024-06-21 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://www.nagios.com/products/security/#nagios-xi | 2024-02-09 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Nagios Search vendor "Nagios" | Nagios Xi Search vendor "Nagios" for product "Nagios Xi" | < 2024 Search vendor "Nagios" for product "Nagios Xi" and version " < 2024" | - |
Affected
| ||||||
Nagios Search vendor "Nagios" | Nagios Xi Search vendor "Nagios" for product "Nagios Xi" | 2024 Search vendor "Nagios" for product "Nagios Xi" and version "2024" | r1 |
Affected
|