CVE-2024-14006

Опубликовано: 30 окт. 2025

Источник: nvd

CVSS3: 6.1

EPSS Низкий

Описание

Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning.

Ссылки

https://www.nagios.com/changelog/nagios-xi/
Release Notes
https://www.nagios.com/products/security/#nagios-xi
Vendor Advisory
https://www.vulncheck.com/advisories/nagios-xi-host-header-injection
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*

Версия до 2024 (исключая)

cpe:2.3:a:nagios:nagios_xi:2024:r1:*:*:*:*:*:*

cpe:2.3:a:nagios:nagios_xi:2024:r1.0.1:*:*:*:*:*:*

cpe:2.3:a:nagios:nagios_xi:2024:r1.0.2:*:*:*:*:*:*

cpe:2.3:a:nagios:nagios_xi:2024:r1.1:*:*:*:*:*:*

cpe:2.3:a:nagios:nagios_xi:2024:r1.1.1:*:*:*:*:*:*

cpe:2.3:a:nagios:nagios_xi:2024:r1.1.2:*:*:*:*:*:*

cpe:2.3:a:nagios:nagios_xi:2024:r1.1.3:*:*:*:*:*:*

cpe:2.3:a:nagios:nagios_xi:2024:r1.1.4:*:*:*:*:*:*

cpe:2.3:a:nagios:nagios_xi:2024:r1.1.5:*:*:*:*:*:*

cpe:2.3:a:nagios:nagios_xi:2024:r1.2:*:*:*:*:*:*

cpe:2.3:a:nagios:nagios_xi:2024:r1.2.1:*:*:*:*:*:*

EPSS

Процентиль: 35%

0.00146

Низкий

6.1 Medium

CVSS3

Дефекты

CWE-346

Связанные уязвимости

GHSA-h24p-c667-33hr

CVSS3: 6.1

github

3 месяца назад

BDU:2025-14539

CVSS3: 8.2

fstec