medium6.1
CVE-2024-14006
Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability.
Impact
Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nagios | Nagios Xi | before 2024 Version 2024 |