Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-53690

Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability in the LDAP/AD authentication-server configuration. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affected page. An attacker who can add authentication servers via LDAP/AD integration could persist a malicious payload that executes in the context of other users' browsers.

Published

2025-10-30T22:15:42.780

Last Modified

2025-11-06T18:20:19.180

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 4.8 (MEDIUM)

Weaknesses

Type: Secondary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	nagios	fusion	< 4.2.0	Yes

References

https://www.nagios.com/changelog/nagios-fusion/ Release Notes ([email protected])
https://www.nagios.com/products/security/#fusion Vendor Advisory ([email protected])
https://www.vulncheck.com/advisories/nagios-fusion-ldap-ad-integration-stored-xss Third Party Advisory ([email protected])