CVE-2023-40932

MediumCVSS 5.4

Published: 19/09/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.03%

60th percentile - higher than 60% of all known CVEs

Summary

A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary JavaScript or HTML via the alt-text field. This affects all pages containing the navbar including the login page, enabling the attacker to steal plaintext credentials.

Risk Assessment

The organization is at risk of credential theft in plaintext and potential takeover of administrative accounts, which could lead to full compromise of the monitoring system.

Recommendation

Immediately upgrade Nagios XI to version 5.11.2 or later, which includes a fix for the XSS vulnerability in the custom logo component.

Original NVD description (English source)

A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means the attacker is able to to steal plaintext credentials.