Lucene search

[email protected]NVD:CVE-2023-38350

HistoryJul 15, 2023 - 2:15 a.m.

CVE-2023-38350

2023-07-1502:15:08

CWE-79

[email protected]

web.nvd.nist.gov

pnp4nagios

stored xss

basket api

filters

ajax controller

security vulnerability

version 0.6.26

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

23.8%

JSON

PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26.

Affected configurations

Nvd

Node

pnp4nagiospnp4nagiosMatch0.6.26

VendorProductVersionCPE
pnp4nagiospnp4nagios0.6.26cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.26:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pnp4nagios	pnp4nagios	0.6.26	cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.26:::::::*

References

github.com/pnp4nagios/pnp4nagios/pull/16