Evil-DB LogoEvil-DB
← All CVEs

CVE-2019-20139

medium · 5.4

In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user.

5.4
CVSS
26.1%
EPSS (exploit prob.)
98th
EPSS percentile
2019-12-30
Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-79

Affected products

VendorProductAffected versions
nagiosnagios_xi5.6.9

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2019-20139