Lucene search

MitreCVE-2019-20139

HistoryDec 30, 2019 - 3:15 p.m.

CVE-2019-20139

2019-12-3015:15:10

CWE-79

mitre

web.nvd.nist.gov

nagios

5.6.9

xss

security vulnerability

authenticated user

admin user

nvd

cve-2019-20139

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.056

Percentile

93.3%

JSON

In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user.

Affected configurations

Nvd

Node

nagiosnagios_xiMatch5.6.9

VendorProductVersionCPE
nagiosnagios_xi5.6.9cpe:2.3:a:nagios:nagios_xi:5.6.9:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nagios	nagios_xi	5.6.9	cpe:2.3:a:nagios:nagios_xi:5.6.9:::::::*

References

code610.blogspot.com/2019/12/multiple-xss-bugs-in-nagios-569.html

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.056

Percentile

93.3%

JSON

Related for CVE-2019-20139