Description
Cross-site scripting (XSS) vulnerability in Nagios 2.x before 2.10 allows remote attackers to inject arbitrary web script or HTML via unknown vectors to unspecified CGI scripts.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | nagios2 | 2.6-2+etch4 | DSA-1883-2, DSA-1883-1 |
Advisories 2
- DSA-1883-1 nagios2 - several cross-site scriptings Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1883-2 nagios2 - regression fix Debian Security (DSA / DLA) · Mar 9, 2026
References
- SUSE-SR:2008:011 vendor-advisory
- FEDORA-2007-4145 vendor-advisory
- MDVSA-2008:067 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=362791
- ADV-2007-3567 vdb-entry
- 27980 third-party-advisory
- http://www.nagios.org/development/changelog.php#2x_branch
- nagios-cgi-xss(37350) vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=362801
- 26152 vdb-entry
- FEDORA-2007-4123 vendor-advisory
- 27316 third-party-advisory