Bug 437849 (CVE-2008-1360) - CVE-2008-1360 nagios cross site scripting
Summary: CVE-2008-1360 nagios cross site scripting
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2008-1360
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://nvd.nist.gov/nvd.cfm?cvename=C...
Whiteboard:
Depends On: 437850 437851 437852 445512
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-03-17 18:55 UTC by Red Hat Product Security
Modified: 2010-12-23 16:44 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2010-12-23 16:44:20 UTC
Embargoed:

Attachments (Terms of Use)
SuSE patch (6.61 KB, patch)
2008-05-14 12:22 UTC, Tomas Hoger 		no flags Details | Diff
View All

Description Lubomir Kundrak 2008-03-17 18:55:15 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-1360 to the following vulnerability:

Cross-site scripting (XSS) vulnerability in Nagios before 2.11 allows remote attackers to inject arbitrary web script or HTML via unknown vectors to unspecified CGI scripts, a different issue than CVE-2007-5624.

References:

http://www.nagios.org/development/changelog.php#2x_branch
http://www.securityfocus.com/bid/28250
http://secunia.com/advisories/29363
Comment 3 Tomas Hoger 2008-05-14 12:22:20 UTC 
Created attachment 305353 [details]
SuSE patch

This fix is present in the upstream version 2.11.

(Extracted from SuSE nagios-2.9-48.4.src.rpm)
Comment 5 Red Hat Bugzilla 2009-10-23 19:04:23 UTC 
Reporter changed to security-response-team by request of Jay Turner.
Comment 6 Vincent Danen 2010-12-23 16:44:20 UTC 
HPC and EPEL4/5 have 2.12 so aren't affected by this, and Fedora has much newer versions.
Note You need to log in before you can comment on or make changes to this bug.