Multiple cross-site scripting (XSS) vulnerabilities in CGI programs in Nagios before 2.12 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2007-5624 and CVE-2008-1360.

Several vulnerabilities have been found in nagios2, a host/service/network monitoring and management system. The Common Vulnerabilities and Exposures project identifies the following problems :

Several cross-site scripting issues via several parameters were discovered in the CGI scripts, allowing attackers to inject arbitrary HTML code. In order to cover the different attack vectors, these issues have been assigned CVE-2007-5624, CVE-2007-5803 and CVE-2008-1360.

Secunia reports :

A vulnerability has been reported in Nagios, which can be exploited by malicious people to conduct cross-site scripting attacks.

This update fixes several cross site scripting (XSS) issues in nagios (CVE-2007-5624, CVE-2007-5803, CVE-2008-1360).

This update fixes several cross-site scripting (XSS) issues in nagios.
(CVE-2007-5624 / CVE-2007-5803 / CVE-2008-1360)

ID	Name	Product	Family	Severity
44748	Debian DSA-1883-1 : nagios2 - missing input sanitising	Nessus	Debian Local Security Checks	medium
32470	FreeBSD : Nagios -- XSS Vulnerability (fbd7aa81-2cc1-11dd-8cfb-00e0815b8da8)	Nessus	FreeBSD Local Security Checks	medium
32117	openSUSE 10 Security Update : nagios (nagios-5168)	Nessus	SuSE Local Security Checks	medium
32116	SuSE 10 Security Update : nagios (ZYPP Patch Number 5165)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2007-5803

medium

Tenable Plugins

medium

medium

medium

medium