VulnerabilityAnalyzed

CVE-2023-7312

Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability when adding or configuring Email Settings.

MEDIUM 6.2EPSS 0.94%

Does this matter?

Lower severity and a low EPSS score (0.94%). Track it; it rarely justifies an emergency change on its own.

Description

Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability when adding or configuring Email Settings. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affected page. An attacker who can add or modify SMTP/email settings or manipulate the sendmail configuration fields could persist a malicious payload that executes in the context of other users' browsers.

CVSS 4.0: 6.2 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.94% probability · 59th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: nagios/fusion
Source: disclosure@vulncheck.com

References

https://www.nagios.com/changelog/nagios-fusion/Product
https://www.nagios.com/products/security/#fusionVendor Advisory
https://www.vulncheck.com/advisories/nagios-fusion-email-settings-stored-xss-via-smtp-sendmailThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.