Nagios 'expand' Parameter Cross Site Scripting Vulnerability

Bugtraq ID:	48087
Class:	Input Validation Error
CVE:	CVE-2011-2179
Remote:	Yes
Local:	No
Published:	Jun 01 2011 12:00AM
Updated:	Apr 13 2015 10:05PM
Credit:	Stefan Schurtz
Vulnerable:	Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Nagios Nagios 3.2.3 Icinga Icinga 1.3 Icinga Icinga 1.2.1 Icinga Icinga 1.4.0
Not Vulnerable:	Icinga Icinga 1.4.1

Nagios 'expand' Parameter Cross Site Scripting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to follow a malicious URI.

The following example URIs are available:

• /data/vulnerabilities/exploits/48087.txt

Nagios 'expand' Parameter Cross Site Scripting Vulnerability

References:

• Cross-Site Scripting vulnerability in Icinga (Stefan Schurtz)
  
• Cross-Site Scripting vulnerability in Nagios (Stefan Schurtz)
  
• Nagios Homepage (Nagios)
  
• Cross-Site Scripting vulnerability in Icinga (Stefan Schurtz)
  
• Cross-Site Scripting vulnerability in Nagios (Stefan Schurtz)