CVE-2013-10074: nagios xi 2012r1.6, 2012r1.7, 2012r1.8 (+7 more affected versions); +1 more affected products

Affected technology

nagios xi · before 2012 (exclusive)
nagios

nagios xi · 2012 · update r1.0
nagios

nagios xi · 2012 · update r1.1
nagios

nagios xi · 2012 · update r1.2
nagios

nagios xi · 2012 · update r1.3
nagios

nagios xi · 2012 · update r1.4
nagios

nagios xi · 2012 · update r1.5
nagios

nagios xi · 2012r1.6
nagios

nagios xi · 2012r1.7
nagios

nagios xi · 2012r1.8
nagios

nagios xi · 2012r1.9
nagios

nagios xi · 2012r2.0
nagios

nagios xi · 2012r2.1
nagios

nagios xi · 2012r2.2
nagios

nagios xi · 2012r2.3
nagios

nagios xi · 2012r2.4
nagios

nagios xi · 2012r2.4 · update b
nagios

nagios xi · 2012r2.5
nagios

XI · 0 to before 2012R2.6
Nagios

Description’s affected range: versions prior to 2012R2.6

Component: Web UI – Tools Menu (page rendering and link helpers)

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction

What an attacker can do

An attacker may inject and execute arbitrary script in the context of a victim's browser. Vendor/CNA’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality, integrity and availability impact as none.