Описание
Cross-site scripting (XSS) vulnerability in Nagios.
A user supplied GET parameter is used to create the value used as the src value of an iframe displayed on all pages. It allows for CSRF and javascript insertion techniques among others.
An attacker could forge a malicious URL that could include javascript execution in the main browser frame context, force the target to view a malicious web page (client side) or take advantage of concurrent cookies / sessions and perform a CSRF attack against other openstack components such as horizon.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 | nagios | Will not fix | ||
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 | nagios | Will not fix | ||
| Red Hat Enterprise Linux OpenStack Platform 6 (Juno) | nagios | Will not fix | ||
| Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) | nagios | Will not fix | ||
| Red Hat Gluster Storage 3.1 | nagios | Will not fix | ||
| Red Hat Mobile Application Platform On-Premise 4.1.0 | nagios | Will not fix | ||
| Red Hat Mobile Application Platform On-Premise 4.2.0 | nagios | Not affected |
Показывать по
10
Дополнительная информация
Статус:
Moderate
Дефект:
CWE-79
https://bugzilla.redhat.com/show_bug.cgi?id=1346217nagios: Reflected XSS vulnerability and possible phishing vector
EPSS
Процентиль: 69%
0.00589
Низкий
4.3 Medium
CVSS2
Связанные уязвимости
CVSS3: 6.1
github
больше 3 лет назад
Cross-site scripting (XSS) vulnerability in Nagios.
EPSS
Процентиль: 69%
0.00589
Низкий
4.3 Medium
CVSS2