Lucene search

[email protected]NVD:CVE-2022-29269

HistoryJun 29, 2022 - 1:15 a.m.

CVE-2022-29269

2022-06-2901:15:07

CWE-79

[email protected]

web.nvd.nist.gov

nagios

schedule report

email injection

html injection

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

34.3%

JSON

In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformatting/editing of emails from an official email address.

Affected configurations

Nvd

Node

nagiosnagios_xiRange≤5.8.5

VendorProductVersionCPE
nagiosnagios_xi*cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nagios	nagios_xi	*	cpe:2.3:a:nagios:nagios_xi::::::::

References

assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT

github.com/4LPH4-NL/CVEs

github.com/sT0wn-nl/CVEs/blob/master/README.md#nagios-xi

www.nagios.com/downloads/nagios-xi/change-log/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

34.3%

JSON

Related for NVD:CVE-2022-29269

cvelist1 cve1 prion1