CVE-2025-56432

A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScript in the context of a logged-in user's session via a specially crafted URL. The issue resides in a web component responsible for rendering performance-related data.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.nagios.com/changelog/	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:nagios:nagios_xi:2024:r2:*:*:*:*:*:*

History

No history.

Information

Published : 2025-08-26 16:15

Updated : 2026-07-05 02:17

NVD link : CVE-2025-56432

Mitre link : CVE-2025-56432

CVE.ORG link : CVE-2025-56432

JSON object : View

Products Affected

nagios

nagios_xi

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-56432", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-56432", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-26T16:04:50.888946Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-08-26T16:15:37.590", "references": [{"url": "https://www.nagios.com/changelog/", "tags": ["Release Notes"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScript in the context of a logged-in user's session via a specially crafted URL. The issue resides in a web component responsible for rendering performance-related data."}, {"lang": "es", "value": "Existe una vulnerabilidad de cross-site scripting (XSS) en Nagios XI 2024R2. Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo JavaScript arbitrario en la sesi\u00f3n de un usuario conectado mediante una URL especialmente manipulada. El problema reside en un componente web responsable de renderizar datos relacionados con el rendimiento."}], "lastModified": "2026-07-05T02:17:00.940", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB1C8BD9-B45A-42EA-9381-7E1E913BAE77"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}