CVE-2020-36862 Nagios XI < 5.6.11 Unauthenticated XSS and SSRF via Highcharts
Unauthenticated attackers can trigger SSRF to access internal resources and inject scripts via Highcharts export, leading to data disclosure and potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36862?
CVE-2020-36862 is a medium-severity server-side request forgery vulnerability in Nagios Nagios Xi, published on 30 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nagios XI versions prior to 5.6.11 contain unauthenticated vulnerabilities in the Highcharts local exporting tool. Crafted export requests could (1) inject script into exported/returned content due to insufficient output encoding (XSS), and (2) cause the server to fetch attacker-specified URLs (SSRF), potentially accessing internal network resources. An unauthenticated remote attacker can leverage these issues to execute script in a user's browser when the exported content is viewed and to disclose sensitive information reachable from the export server via SSRF.
Which versions are affected by CVE-2020-36862?
It affects 1 product.
Products include Nagios Nagios Xi.
How do I fix CVE-2020-36862?
No fix has been published for CVE-2020-36862 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-36862 being exploited?
There is no known exploitation of CVE-2020-36862 in the wild and no public exploit code.
Other vulnerabilities in Nagios Nagios Xi
Sources
Also known as GHSA-h589-95j6-wh7x.