CVE-2019-20139

In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

26.11% chance of exploitation in the next 30 days, 98th percentile

Published

2019-12-30

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://code610.blogspot.com/2019/12/multiple-xss-bugs-in-nagios-569.html

References

• CVE Record
• NVD entry

Related

• CVE-2019-20100
• CVE-2019-20140
• CVE-2019-20099
• CVE-2019-20141
• CVE-2019-20098
• CVE-2019-20149