CVE-2023-40932

MediumCVSS 5.4/10Last modified Jul 9, 2026

Description

A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means the attacker is able to to steal plaintext credentials.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://outpost24.com/blog/nagios-xi-vulnerabilities/Third Party Advisory
https://www.nagios.com/products/security/Vendor Advisory
https://outpost24.com/blog/nagios-xi-vulnerabilities/Third Party Advisory
https://www.nagios.com/products/security/Vendor Advisory

Timeline

Published: Sep 19, 2023
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-409338.8A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privilege CVE-2023-409347.2A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the CVE-2023-40948.2ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block e CVE-2023-409429.8Tenda AC9 V3.0BR_V15.03.06.42_multi_TD01 was discovered stack overflow via parameter 'firewall_value' at url /goform/SetFirewallCfg.CVE-2023-409449.8Schoolmate 1.3 is vulnerable to SQL Injection in the variable $schoolname from Database at ~\header.php.CVE-2023-409459.8Sourcecodester Doctor Appointment System 1.0 is vulnerable to SQL Injection in the variable $userid at doctors\myDetails.php.CVE-2023-409469.8Schoolmate 1.3 is vulnerable to SQL Injection in the variable $username from SESSION in ValidateLogin.php.CVE-2023-40955.3User enumeration vulnerability in Arconte Áurea 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to obtain a CVE-2023-409538.8icms 7.0.16 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2023-409549.8A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, CVE-2023-409558.8A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0 CVE-2023-409568.8A SQL injection vulnerability in Cloudroits Website Job Search v.15.0 allows a remote authenticated attacker to execute arbitrary code via t