What is CVE-2018-10554?

CVE-2018-10554 is a medium-severity vulnerability in Nagios Xi, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2018-04-30.

How severe is CVE-2018-10554?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in Nagios Xi

CVE-2018-10554

An issue was discovered in Nagios XI 5.4.13. There is XSS exploitable via CSRF in (1) the Schedule New Report screen via the hour, minute, or ampm parameter, related to components/scheduledreporting; (2) includes/components/xicore/downtime.php, related to the update_pages function; (3) the ajaxhelper.php opts or background parameter; (4) the i[] array parameter to ajax_handler.php; or (5) the deploynotification.php title parameter.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.027 (84.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Nagios Nagios_xi — versions 5.4.13
N/a — versions n/a

Weakness classification (CWE)

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-10554?: CVE-2018-10554 is a medium-severity vulnerability in Nagios Xi, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2018-04-30.
How severe is CVE-2018-10554?: Medium severity. CVSS v3 base score is 5.4 out of 10.