Servers and applications
CVE-2018-17146
A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the auto login admin management page.
- Severity
- Medium 5.4
- Published
- 19 Jun 2019
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 5.5.4
- Exploit chance
- 3.5% in the next 30 daysHigher than 89% of CVEs. EPSS by FIRST, 10 Nov 2026
- Weakness
- Cross-site scripting (CWE-79)
- Attack
- Over the network · Needs a user account · Needs someone to click or open something
- Attacker can
- Read some data · Change some data
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Nagios XIServers and applications · cpe:a:nagios:nagios_xi |
|