CVE-2025-34278

Nagios Network Analyzer versions prior to 2024R1 contain a stored cross-site scripting (XSS) vulnerability in the Source Groups page (percentile calculator menu). An attacker can supply a malicious payload which is stored by the application and later rendered in the context of other users. When a victim views the affected page the injected script executes in the victim's browser context.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.nagios.com/changelog/#network-analyzer	Release Notes
https://www.nagios.com/products/security/#network-analyzer	Product
https://www.vulncheck.com/advisories/nagios-network-analyzer-source-groups-percentile-calculator-menu-stored-xss	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nagios:network_analyzer:*:*:*:*:*:*:*:*

History

07 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Versiones de Nagios Network Analyzer anteriores a 2024R1 contienen una vulnerabilidad de cross-site scripting (XSS) almacenada en la página de Grupos de Origen (menú de la calculadora de percentiles). Un atacante puede proporcionar una carga útil maliciosa que es almacenada por la aplicación y posteriormente renderizada en el contexto de otros usuarios. Cuando una víctima ve la página afectada, el script inyectado se ejecuta en el contexto del navegador de la víctima.

Information

Published : 2025-10-30 22:15

Updated : 2026-10-07 21:10

NVD link : CVE-2025-34278

Mitre link : CVE-2025-34278

CVE.ORG link : CVE-2025-34278

JSON object : View

Products Affected

nagios

network_analyzer

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-34278", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34278", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-31T15:10:02.897466Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Nagios", "modules": ["Source Groups page \u2014 percentile calculator menu"], "product": "Network Analyzer", "versions": [{"status": "affected", "version": "0", "lessThan": "2024R1", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-30T22:15:48.360", "references": [{"url": "https://www.nagios.com/changelog/#network-analyzer", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.nagios.com/products/security/#network-analyzer", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/nagios-network-analyzer-source-groups-percentile-calculator-menu-stored-xss", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Nagios Network Analyzer versions prior to\u00a02024R1 contain a stored cross-site scripting (XSS) vulnerability in the Source Groups page\u00a0(percentile calculator menu).\u00a0An attacker can supply a malicious payload which is stored by the application and later rendered in the context of other users. When a victim views the affected page the injected script executes in the victim's browser context."}, {"lang": "es", "value": "Versiones de Nagios Network Analyzer anteriores a 2024R1 contienen una vulnerabilidad de cross-site scripting (XSS) almacenada en la p\u00e1gina de Grupos de Origen (men\u00fa de la calculadora de percentiles). Un atacante puede proporcionar una carga \u00fatil maliciosa que es almacenada por la aplicaci\u00f3n y posteriormente renderizada en el contexto de otros usuarios. Cuando una v\u00edctima ve la p\u00e1gina afectada, el script inyectado se ejecuta en el contexto del navegador de la v\u00edctima."}], "lastModified": "2026-10-07T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nagios:network_analyzer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F1712DB-0BE7-4F0D-B589-FC00198554DC", "versionEndExcluding": "2024"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}