Home

Description

The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.4 / Nagios XI 5.8.6 contains a reflected cross-site scripting (XSS) vulnerability via the Test Command functionality. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

PUBLISHED Reserved 2025-10-29 | Published 2025-10-30 | Updated 2025-10-31 | Assigner VulnCheck




MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

CWE-116 Improper Encoding or Escaping of Output

Product status

Default status
unaffected

Any version before 5.8.6
affected

Credits

Amit Raut of Trend Micro Security Research working with Trend Micro Zero Day Initiative finder

References

www.nagios.com/changelog/nagios-xi/ release-notes patch

www.vulncheck.com/...s-xi-ccm-reflected-xss-via-test-command third-party-advisory

cve.org (CVE-2021-47694)

nvd.nist.gov (CVE-2021-47694)

Download JSON