Описание
Cross-site scripting (XSS) vulnerability in Nagios.
A user supplied GET parameter is used to create the value used as the src value of an iframe displayed on all pages. It allows for CSRF and javascript insertion techniques among others.
An attacker could forge a malicious URL that could include javascript execution in the main browser frame context, force the target to view a malicious web page (client side) or take advantage of concurrent cookies / sessions and perform a CSRF attack against other openstack components such as horizon.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) | nagios | Will not fix | ||
| Red Hat Enterprise Linux OpenStack Platform 6 (Juno) | nagios | Will not fix | ||
| Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) | nagios | Will not fix | ||
| Red Hat Mobile Application Platform 4 | nagios | Will not fix | ||
| Red Hat Storage 3 | nagios | Will not fix |
Показывать по
10
Дополнительная информация
Статус:
Moderate
Дефект:
CWE-79
https://bugzilla.redhat.com/show_bug.cgi?id=1346217nagios: Reflected XSS vulnerability and possible phishing vector
4.3 Medium
CVSS2
Связанные уязвимости
CVSS3: 6.1
github
больше 4 лет назад
Cross-site scripting (XSS) vulnerability in Nagios.
4.3 Medium
CVSS2