CVE-2011-2179 Information

Description

Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter as demonstrated by an (a) command action or a (b) hosts action.

Reference

http://archives.neohapsis.com/archives/bugtraq/2011-06/0017.html http://archives.neohapsis.com/archives/bugtraq/2011-06/0018.html http://secunia.com/advisories/44974 http://securityreason.com/securityalert/8274 http://tracker.nagios.org/view.php?id=224 http://www.openwall.com/lists/oss-security/2011/06/01/10 http://www.openwall.com/lists/oss-security/2011/06/02/6 http://www.rul3z.de/advisories/SSCHADV2011-005.txt http://www.rul3z.de/advisories/SSCHADV2011-006.txt http://www.securityfocus.com/bid/48087 http://www.ubuntu.com/usn/USN-1151-1 https://bugzilla.redhat.com/show_bug.cgi?id=709871 https://dev.icinga.org/issues/1605 https://exchange.xforce.ibmcloud.com/vulnerabilities/67797