Nagios
Nagios Fusion: vulnerabilidades y CVE
Nagios Fusion tiene 19 vulnerabilidades publicadas, 7 de ellas en los últimos 12 meses. 6 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE19
Últimos 12 meses7
Críticas6
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2023-7312 | Media (6.2) | 1.0% | — | 30 oct 2025 | Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability when adding or configuring Email Settings. Unsanitized user input can be stored and later rendered in the administrative… |
| CVE-2023-53690 | Media (6.2) | 0.82% | — | 30 oct 2025 | Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability in the LDAP/AD authentication-server configuration. Unsanitized user input can be stored and later rendered in the… |
| CVE-2023-53689 | Media (6) | 0.89% | — | 30 oct 2025 | Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting (XSS) vulnerability in the license key configuration flow that can result in execution of attacker-controlled script in the browser of a… |
| CVE-2018-25119 | Media (5.1) | 0.52% | — | 30 oct 2025 | Nagios Fusion versions prior to 4.1.5 are vulnerable to cross-site scripting (XSS) via the "fusionwindow" parameter. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute… |
| CVE-2017-20209 | Media (5.1) | 0.52% | — | 30 oct 2025 | Nagios Fusion versions prior to 4.0.1 are vulnerable to cross-site scripting (XSS) via the Users and Servers pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute… |
| CVE-2025-60425 | Alta (8.6) | 0.98% | — | 27 oct 2025 | Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack. |
| CVE-2025-60424 | Alta (7.6) | 0.71% | — | 27 oct 2025 | A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack. |
| CVE-2020-28911 | Media (6.5) | 2.7% | — | 24 may 2021 | Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the test_server command in ajaxhelper.php. |
| CVE-2020-28909 | Alta (8.8) | 5.1% | — | 24 may 2021 | Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges users are able to modify files that can be executed by sudo. |
| CVE-2020-28908 | Crítica (9.8) | 5.7% | — | 24 may 2021 | Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios. |
| CVE-2020-28907 | Crítica (9.8) | 3.4% | — | 24 may 2021 | Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an untrusted update package in… |
| CVE-2020-28906 | Alta (8.8) | 4.7% | — | 24 may 2021 | Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged users are able to modify files that are included (aka sourced) by… |
| CVE-2020-28905 | Alta (8.8) | 26% | — | 24 may 2021 | Improper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination. |
| CVE-2020-28904 | Crítica (9.8) | 3.6% | — | 24 may 2021 | Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code. |
| CVE-2020-28903 | Media (6.1) | 10% | — | 24 may 2021 | Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary HTML, aka XSS. |
| CVE-2020-28902 | Crítica (9.8) | 6.4% | — | 24 may 2021 | Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php. |
| CVE-2020-28901 | Crítica (9.8) | 9.1% | — | 24 may 2021 | Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component installation in cmd_subsys.php. |
| CVE-2020-28900 | Crítica (9.8) | 2.4% | — | 24 may 2021 | Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to an untrusted update… |
| CVE-2018-12501 | Media (6.1) | 1.7% | — | 16 jun 2018 | Nagios Fusion before 4.1.4 has XSS, aka TPS#13332-13335. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.