Cross-site scripting (XSS) vulnerability in statusmap.c in statusmap.cgi in Nagios 3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the layer parameter.

statusmap.cgi and config.cgi were prone to cross-site scripting (XSS) vulnerabilities (CVE-2011-1523, CVE-2011-2179).

statusmap.cgi was prone to a cross-site scripting (XSS) vulnerability (CVE-2011-1523).

This update fixes and issue where statusmap.cgi was prone to a cross-site scripting (XSS) vulnerability. (CVE-2011-1523)

The following bug has been fixed :

  - statusmap.cgi was prone to a cross-site scripting (XSS)     vulnerability. (CVE-2011-1523)

statusmap.cgi was prone to a cross-site scripting (XSS) vulnerability.
(CVE-2011-1523)

Stefan Schurtz discovered than Nagios did not properly sanitize its input when processing certain requests, resulting in cross-site scripting (XSS) vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75971	openSUSE Security Update : nagios (openSUSE-SU-2011:0836-1)	Nessus	SuSE Local Security Checks	medium
75676	openSUSE Security Update : nagios (openSUSE-SU-2011:0833-1)	Nessus	SuSE Local Security Checks	medium
57229	SuSE 10 Security Update : nagios (ZYPP Patch Number 7625)	Nessus	SuSE Local Security Checks	medium
55687	SuSE 10 Security Update : nagios (ZYPP Patch Number 7624)	Nessus	SuSE Local Security Checks	medium
55565	SuSE 11.1 Security Update : nagios (SAT Patch Number 4849)	Nessus	SuSE Local Security Checks	medium
55163	Ubuntu 10.04 LTS / 10.10 / 11.04 : nagios3 vulnerabilities (USN-1151-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2011-1523

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium