CVE-2023-40932 Cross-site scripting in n/a
Authenticated attackers can inject JavaScript via the custom logo alt-text field to steal plaintext credentials from all pages including the login screen.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-40932?
CVE-2023-40932 is a medium-severity cross-site scripting vulnerability in Nagios Nagios Xi, published on 19 Sep 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means the attacker is able to to steal plaintext credentials.
Weakness: CWE-79
Which versions are affected by CVE-2023-40932?
It affects 1 product.
Products include Nagios Nagios Xi.
How do I fix CVE-2023-40932?
No fix has been published for CVE-2023-40932 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-40932 being exploited?
There is no known exploitation of CVE-2023-40932 in the wild and no public exploit code.
Other vulnerabilities in Nagios Nagios Xi
Sources
Also known as GHSA-545q-9j8x-q2gf.