« Volver al listado

CVE-2024-14006

Estado: AnalizadaAlta (8.8)—

Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de inyección de Host header en aplicación web remota sin autenticación (AV:N, PR:N, UI:N). Permite envenenamiento de URLs para phishing de credenciales, secuestro de enlaces de recuperación y poisoning de caché web.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingFilter Network TrafficSoftware ConfigurationVulnerability ScanningUser Account ManagementRestrict Web-Based Content

Tecnologías afectadas (1)

Nagios — Nagios XI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-14006",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-14006",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-10-31T13:04:28.191606Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.8,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "vendor": "Nagios",
          "modules": [
            "HTTP request handling / URL construction"
          ],
          "product": "XI",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2024R1.2.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-10-30T22:15:46.153",
  "references": [
    {
      "url": "https://www.nagios.com/changelog/nagios-xi/",
      "tags": [
        "Release Notes"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.nagios.com/products/security/#nagios-xi",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.vulncheck.com/advisories/nagios-xi-host-header-injection",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning."
    },
    {
      "lang": "es",
      "value": "Las versiones de Nagios XI anteriores a 2024R1.2.2 contienen una vulnerabilidad de inyección de encabezado de host. La aplicación confía en el encabezado Host HTTP proporcionado por el usuario al construir URLs absolutas sin validación suficiente. Un atacante remoto no autenticado puede suministrar un encabezado Host manipulado para envenenar enlaces o respuestas generados, lo que puede facilitar el phishing de credenciales, el secuestro de enlaces de recuperación de cuentas y el envenenamiento de la caché web."
    }
  ],
  "lastModified": "2026-10-02T00:10:00.180",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62CF7BF4-6AAA-443E-93B4-B2F080091C13",
              "versionEndExcluding": "2024"
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85F1764D-1DD8-44B0-BF5A-2420CB519A3C"
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.0.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1FE1A0B-78D1-4626-A4CD-21B843DA596E"
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.0.2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CCAB888E-F030-4640-9A18-9E423E553308"
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C648B0A4-053C-4884-8A37-4AF03053ED1C"
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.1.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "893EEA99-0096-4C9F-BA8A-246A3E3F6C15"
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.1.2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1FDA3F3-DF79-4807-9451-F04B2DB9A2B6"
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.1.3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E055065-35A7-458A-A2DB-26634B97EE7C"
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.1.4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "76946B2D-093C-4981-8465-5ADBB98C0676"
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.1.5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E9112876-7C61-4A72-8F91-023378E82E6D"
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1443759F-EBD7-4366-A5D3-9FB15CE15B40"
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.2.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F85D8CA4-F1AC-4538-925C-1AD00FF7B9C1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com"
}