VulnerabilityModified
CVE-2014-4907
Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message.
MEDIUM 4.3EPSS 2.21%
Does this matter?
Lower severity and a low EPSS score (2.21%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 2.21% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- op5/monitor · pnp4nagios/pnp4nagios
- Source
- cve@mitre.org
References
- http://docs.pnp4nagios.org/pnp-0.6/dwnldPatch
- http://openwall.com/lists/oss-security/2014/07/11/3
- http://secunia.com/advisories/59535
- http://secunia.com/advisories/59603
- http://sourceforge.net/p/pnp4nagios/code/ci/f846a6c9d007ca2bee05359af747619151195fc9Exploit, Patch
- http://www.op5.com/blog/news/op5-monitor-6-3-1-release-notesVendor Advisory
- http://www.securityfocus.com/bid/68350
- https://bugs.op5.com/view.php?id=8761
- http://docs.pnp4nagios.org/pnp-0.6/dwnldPatch
- http://openwall.com/lists/oss-security/2014/07/11/3
- http://secunia.com/advisories/59535
- http://secunia.com/advisories/59603
- http://sourceforge.net/p/pnp4nagios/code/ci/f846a6c9d007ca2bee05359af747619151195fc9Exploit, Patch
- http://www.op5.com/blog/news/op5-monitor-6-3-1-release-notesVendor Advisory
- http://www.securityfocus.com/bid/68350
- https://bugs.op5.com/view.php?id=8761
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.