Количество 3
Количество 3
CVE-2024-14006
Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning.
GHSA-h24p-c667-33hr
Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning.
BDU:2025-14539
Уязвимость инструмента для мониторинга ИТ-инфраструктуры Nagios XI, связанная с ошибкой подтверждения источника данных, позволяющая нарушителю проводить фишинг-атаки
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2024-14006 Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning. | CVSS3: 6.1 | 0% Низкий | 10 месяцев назад |
| GHSA-h24p-c667-33hr Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning. | CVSS3: 6.1 | 0% Низкий | 10 месяцев назад |
 | BDU:2025-14539 Уязвимость инструмента для мониторинга ИТ-инфраструктуры Nagios XI, связанная с ошибкой подтверждения источника данных, позволяющая нарушителю проводить фишинг-атаки | CVSS3: 8.2 | 0% Низкий | 10 месяцев назад |
Уязвимостей на страницу