CVE-2011-10037: nagios xi through 2009 (inclusive), 2011 · update r1, 2011 · update r1.1 (+7 more affected versions); +1 more affected…

Affected technology

nagios xi · through 2009 (inclusive)
nagios

nagios xi · 2011 · update r1
nagios

nagios xi · 2011 · update r1.1
nagios

nagios xi · 2011 · update r1.2
nagios

nagios xi · 2011 · update r1.3
nagios

nagios xi · 2011 · update r1.4
nagios

nagios xi · 2011 · update r1.5
nagios

nagios xi · 2011 · update r1.6
nagios

nagios xi · 2011 · update r1.7
nagios

nagios xi · 2011 · update r1.8
nagios

XI · 0 to before 2011R1.9
Nagios

Description’s affected range: versions prior to 2011R1.9

Component: Web UI – xiwindow variables / permalink renderer

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction

What an attacker can do

An attacker may inject and execute arbitrary script in the context of a victim's browser. Vendor/CNA’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality, integrity and availability impact as none.