Description
Cross-site scripting (XSS) vulnerability in statusmap.c in statusmap.cgi in Nagios 3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the layer parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nagios | 4.4.6-2.5 | openSUSE-SU-2024:11073-1 |
Advisories 1
- openSUSE-SU-2024:11073-1 nagios-4.4.6-2.5 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- 8241 third-party-advisory
- 43287 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=690877
- http://tracker.nagios.org/view.php?id=207
- http://www.rul3z.de/advisories/SSCHADV2011-002.txt
- 44974 third-party-advisory
- [oss-security] 20110325 CVE Request -- Nagios -- XSS in the network status map CGI script mailing-list
- USN-1151-1 vendor-advisory
- [oss-security] 20110328 Re: CVE Request -- Nagios -- XSS in the network status map CGI script mailing-list