CVE-2013-10074

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2013-10074", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2025-10-28T21:16:35.330Z", "datePublished": "2025-10-30T21:56:22.290Z", "dateUpdated": "2025-11-17T18:21:37.954Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Web UI \u2013 Tools Menu (page rendering and link helpers)"], "product": "XI", "vendor": "Nagios", "versions": [{"lessThan": "2012R2.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:nagios:nagios_xi:2012:*:*:*:*:*:*:*", "versionEndExcluding": "r2.6"}]}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Nagios XI versions prior to&nbsp;2012R2.6&nbsp;are vulnerable to cross-site scripting (XSS) via the Tools Menu of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.<br>"}], "value": "Nagios XI versions prior to\u00a02012R2.6\u00a0are vulnerable to cross-site scripting (XSS) via the Tools Menu of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2025-11-17T18:21:37.954Z"}, "references": [{"tags": ["release-notes", "patch"], "url": "https://www.nagios.com/changelog/nagios-xi/"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/nagios-xi-xss-via-tools-menu"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Nagios addresses this vulnerability as \"Fix XSS vulnerability in Tools Menu. User would have needed account on system to be able to inject items in their own page, but is now resolved.\"<br>"}], "value": "Nagios addresses this vulnerability as \"Fix XSS vulnerability in Tools Menu. User would have needed account on system to be able to inject items in their own page, but is now resolved.\""}], "source": {"discovery": "UNKNOWN"}, "title": "Nagios XI < 2012R2.6 XSS via Tools Menu", "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-31T12:29:45.841727Z", "id": "CVE-2013-10074", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-31T12:29:54.947Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2013-10074", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-31T12:29:45.841727Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-31T12:29:50.480Z"}}], "cna": {"title": "Nagios XI < 2012R2.6 XSS via Tools Menu", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Nagios", "modules": ["Web UI \u2013 Tools Menu (page rendering and link helpers)"], "product": "XI", "versions": [{"status": "affected", "version": "0", "lessThan": "2012R2.6", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Nagios addresses this vulnerability as \"Fix XSS vulnerability in Tools Menu. User would have needed account on system to be able to inject items in their own page, but is now resolved.\"", "supportingMedia": [{"type": "text/html", "value": "Nagios addresses this vulnerability as \"Fix XSS vulnerability in Tools Menu. User would have needed account on system to be able to inject items in their own page, but is now resolved.\"<br>", "base64": false}]}], "references": [{"url": "https://www.nagios.com/changelog/nagios-xi/", "tags": ["release-notes", "patch"]}, {"url": "https://www.vulncheck.com/advisories/nagios-xi-xss-via-tools-menu", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Nagios XI versions prior to\u00a02012R2.6\u00a0are vulnerable to cross-site scripting (XSS) via the Tools Menu of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.", "supportingMedia": [{"type": "text/html", "value": "Nagios XI versions prior to&nbsp;2012R2.6&nbsp;are vulnerable to cross-site scripting (XSS) via the Tools Menu of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nagios:nagios_xi:2012:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "r2.6"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2025-11-17T18:21:37.954Z"}}}, "cveMetadata": {"cveId": "CVE-2013-10074", "state": "PUBLISHED", "dateUpdated": "2025-11-17T18:21:37.954Z", "dateReserved": "2025-10-28T21:16:35.330Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2025-10-30T21:56:22.290Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Web UI \u2013 Tools Menu (page rendering and link helpers)"], "product": "XI", "vendor": "Nagios", "versions": [{"lessThan": "2012R2.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*", "matchCriteriaId": "80AE04CF-7CBB-40D9-816E-A481096AA647", "versionEndExcluding": "2012", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012:r1.0:*:*:*:*:*:*", "matchCriteriaId": "63DC3A03-8CB1-489F-86D2-13F271C2C48D", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012:r1.1:*:*:*:*:*:*", "matchCriteriaId": "653ED130-C4EC-4EC1-AE81-99BA7F888B33", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012:r1.2:*:*:*:*:*:*", "matchCriteriaId": "B28B0CDB-0E18-4702-B498-C89431095C0D", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012:r1.3:*:*:*:*:*:*", "matchCriteriaId": "14CF14F0-7115-4AB6-B35F-BDBE298420CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012:r1.4:*:*:*:*:*:*", "matchCriteriaId": "5B3E6044-06C2-46B2-92AD-C79C287A0018", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012:r1.5:*:*:*:*:*:*", "matchCriteriaId": "DAED5B87-54DB-4AB2-AB0E-1D75EF1F8C7F", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012r1.6:*:*:*:*:*:*:*", "matchCriteriaId": "09685D17-FE3A-4572-BA07-3A223BE1E489", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012r1.7:*:*:*:*:*:*:*", "matchCriteriaId": "68187520-9D07-4F42-8FB9-DA8E5C939F58", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012r1.8:*:*:*:*:*:*:*", "matchCriteriaId": "CBDB6D28-F9D2-41FB-92B2-4FDC32A8BC88", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012r1.9:*:*:*:*:*:*:*", "matchCriteriaId": "DA473BE3-4FA0-48F7-88BC-11B4F1AFBF0C", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012r2.0:*:*:*:*:*:*:*", "matchCriteriaId": "D34178BE-D99F-4EFE-890E-19030F635D15", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012r2.1:*:*:*:*:*:*:*", "matchCriteriaId": "AB7CAE8E-43FA-4762-B8C1-9A476F088655", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012r2.2:*:*:*:*:*:*:*", "matchCriteriaId": "910F1485-12D0-4A48-9AED-94CAA56D6FF4", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012r2.3:*:*:*:*:*:*:*", "matchCriteriaId": "844CF55A-BBC5-4C31-85A3-5D5E7FEAF1A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012r2.4:*:*:*:*:*:*:*", "matchCriteriaId": "7868FC0F-A302-43D5-80D1-9EDD091057C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012r2.4:b:*:*:*:*:*:*", "matchCriteriaId": "BEBFBA42-C832-4094-BF5A-9C196625443F", "vulnerable": true}, {"criteria": "cpe:2.3:a:nagios:nagios_xi:2012r2.5:*:*:*:*:*:*:*", "matchCriteriaId": "E7424428-1FB1-49A7-9CFF-25843433660D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nagios XI versions prior to\u00a02012R2.6\u00a0are vulnerable to cross-site scripting (XSS) via the Tools Menu of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser."}, {"lang": "es", "value": "Las versiones de Nagios XI anteriores a 2012R2.6 son vulnerables a cross-site scripting (XSS) a trav\u00e9s del Men\u00fa de Herramientas de la interfaz web. La validaci\u00f3n o el escape insuficientes de la entrada proporcionada por el usuario pueden permitir a un atacante inyectar y ejecutar scripts arbitrarios en el contexto del navegador de una v\u00edctima."}], "id": "CVE-2013-10074", "lastModified": "2026-10-18T00:10:00.123", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2013-10074", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-31T12:29:45.841727Z", "version": "2.0.3"}}]}, "published": "2025-10-30T22:15:36.507", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Release Notes"], "url": "https://www.nagios.com/changelog/nagios-xi/"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/nagios-xi-xss-via-tools-menu"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"created": "2025-10-31T10:13:33.247124+00:00", "updated": "2025-10-31T10:13:33.247159+00:00", "vendors": ["nagios", "nagios$PRODUCT$xi"]}