CVE-2022-38251

Deeper analysis

Nagios XI version 5.8.6 contains a stored cross-site scripting vulnerability (CWE-79) on the System Performance Settings page in the administrative interface. The flaw received a CVSS 3.1 score of 4.8, reflecting network attack vector, low attack complexity, high privileges required, and required user interaction, with limited confidentiality and integrity impact in a changed scope.

An authenticated administrator can supply crafted input that is later rendered for other users who view the affected page, enabling execution of attacker-controlled scripts within the Nagios XI web application. Successful exploitation can lead to session hijacking, privilege escalation within the application, or unauthorized actions performed in the context of other administrative users.

The vendor's change log for Nagios XI 5.8.7 documents the release that addresses the issue, indicating that upgrading from the vulnerable 5.8.6 version eliminates the XSS vector. The associated EPSS score has remained flat at 0.3610 with no material increase after disclosure.