CVE-2023-7312

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-7312", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2025-10-17T15:49:12.091Z", "datePublished": "2025-10-30T21:19:51.723Z", "dateUpdated": "2025-11-17T21:36:23.135Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Email Settings"], "product": "Fusion", "vendor": "Nagios", "versions": [{"lessThan": "4.2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:nagios:fusion:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.2.0"}]}]}], "credits": [{"lang": "en", "type": "finder", "value": "Tisha Manandhar"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Nagios Fusion versions prior to&nbsp;4.2.0 contain a stored cross-site scripting (XSS) vulnerability when&nbsp;adding or configuring Email Settings. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affected page. An attacker who can add or modify SMTP/email settings or manipulate the sendmail configuration fields could persist a malicious payload that executes in the context of other users' browsers.<br>"}], "value": "Nagios Fusion versions prior to\u00a04.2.0 contain a stored cross-site scripting (XSS) vulnerability when\u00a0adding or configuring Email Settings. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affected page. An attacker who can add or modify SMTP/email settings or manipulate the sendmail configuration fields could persist a malicious payload that executes in the context of other users' browsers."}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.2, "baseSeverity": "MEDIUM", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2025-11-17T21:36:23.135Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.nagios.com/products/security/#fusion"}, {"tags": ["release-notes", "patch"], "url": "https://www.nagios.com/changelog/nagios-fusion/"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/nagios-fusion-email-settings-stored-xss-via-smtp-sendmail"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Nagios addresses this vulnerability as \"Stored XSS when adding Email Settings via SMTP,\" \"Stored XSS when configuring Email Settings via sendmail,\" and \"Fixed XSS in Admin-&gt;Email Settings.\"</span><br>"}], "value": "Nagios addresses this vulnerability as \"Stored XSS when adding Email Settings via SMTP,\" \"Stored XSS when configuring Email Settings via sendmail,\" and \"Fixed XSS in Admin->Email Settings.\""}], "source": {"discovery": "UNKNOWN"}, "title": "Nagios Fusion < 4.2.0 Email Settings Stored XSS via SMTP/sendmail", "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-03T18:36:58.549361Z", "id": "CVE-2023-7312", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T18:37:04.782Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-7312", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-03T18:36:58.549361Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T18:37:01.424Z"}}], "cna": {"title": "Nagios Fusion < 4.2.0 Email Settings Stored XSS via SMTP/sendmail", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Tisha Manandhar"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Nagios", "modules": ["Email Settings"], "product": "Fusion", "versions": [{"status": "affected", "version": "0", "lessThan": "4.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Nagios addresses this vulnerability as \"Stored XSS when adding Email Settings via SMTP,\" \"Stored XSS when configuring Email Settings via sendmail,\" and \"Fixed XSS in Admin->Email Settings.\"", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Nagios addresses this vulnerability as \"Stored XSS when adding Email Settings via SMTP,\" \"Stored XSS when configuring Email Settings via sendmail,\" and \"Fixed XSS in Admin-&gt;Email Settings.\"</span><br>", "base64": false}]}], "references": [{"url": "https://www.nagios.com/products/security/#fusion", "tags": ["vendor-advisory", "patch"]}, {"url": "https://www.nagios.com/changelog/nagios-fusion/", "tags": ["release-notes", "patch"]}, {"url": "https://www.vulncheck.com/advisories/nagios-fusion-email-settings-stored-xss-via-smtp-sendmail", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Nagios Fusion versions prior to\u00a04.2.0 contain a stored cross-site scripting (XSS) vulnerability when\u00a0adding or configuring Email Settings. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affected page. An attacker who can add or modify SMTP/email settings or manipulate the sendmail configuration fields could persist a malicious payload that executes in the context of other users' browsers.", "supportingMedia": [{"type": "text/html", "value": "Nagios Fusion versions prior to&nbsp;4.2.0 contain a stored cross-site scripting (XSS) vulnerability when&nbsp;adding or configuring Email Settings. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affected page. An attacker who can add or modify SMTP/email settings or manipulate the sendmail configuration fields could persist a malicious payload that executes in the context of other users' browsers.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nagios:fusion:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.2.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2025-11-17T21:36:23.135Z"}}}, "cveMetadata": {"cveId": "CVE-2023-7312", "state": "PUBLISHED", "dateUpdated": "2025-11-17T21:36:23.135Z", "dateReserved": "2025-10-17T15:49:12.091Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2025-10-30T21:19:51.723Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Email Settings"], "product": "Fusion", "vendor": "Nagios", "versions": [{"lessThan": "4.2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nagios:fusion:*:*:*:*:*:*:*:*", "matchCriteriaId": "C952BF8F-1658-4707-AB70-427476FC5FB9", "versionEndExcluding": "4.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nagios Fusion versions prior to\u00a04.2.0 contain a stored cross-site scripting (XSS) vulnerability when\u00a0adding or configuring Email Settings. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affected page. An attacker who can add or modify SMTP/email settings or manipulate the sendmail configuration fields could persist a malicious payload that executes in the context of other users' browsers."}, {"lang": "es", "value": "Las versiones de Nagios Fusion anteriores a la 4.2.0 contienen una vulnerabilidad de cross-site scripting (XSS) almacenada al a\u00f1adir o configurar los Ajustes de Correo Electr\u00f3nico. La entrada de usuario no saneada puede ser almacenada y posteriormente renderizada en la interfaz de usuario administrativa, causando que JavaScript se ejecute en el navegador de cualquier usuario que vea la p\u00e1gina afectada. Un atacante que pueda a\u00f1adir o modificar los ajustes SMTP/de correo electr\u00f3nico o manipular los campos de configuraci\u00f3n de sendmail podr\u00eda persistir una carga \u00fatil maliciosa que se ejecuta en el contexto de los navegadores de otros usuarios."}], "id": "CVE-2023-7312", "lastModified": "2026-10-18T00:10:00.123", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-7312", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-03T18:36:58.549361Z", "version": "2.0.3"}}]}, "published": "2025-10-30T22:15:42.930", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://www.nagios.com/changelog/nagios-fusion/"}, {"source": "disclosure@vulncheck.com", "tags": ["Vendor Advisory"], "url": "https://www.nagios.com/products/security/#fusion"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/nagios-fusion-email-settings-stored-xss-via-smtp-sendmail"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"created": "2025-10-31T10:13:56.077193+00:00", "updated": "2025-10-31T10:13:56.077217+00:00", "vendors": ["nagios", "nagios$PRODUCT$fusion"]}