pnp4nagios: cross-site scripting
| Package(s): | pnp4nagios | CVE #(s): | CVE-2014-4908 CVE-2014-4907 | ||||||||||||
| Created: | July 14, 2014 | Updated: | May 12, 2015 | ||||||||||||
| Description: | From the Red Hat bugzilla:
CVE-2014-4908: Two vulnerabilities have been reported in PNP4Nagios, which can be exploited by malicious people to conduct cross-site scripting attacks. 1) Input appended to the URL is not properly sanitised in "views/kohana_error_page.php" before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. 2) Input appended to the URL is not properly sanitised in "views/template.php" before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. CVE-2014-4907: The 0.6.22 release of PNP4Nagios fixes a cross-site scripting flaw in an error page. An attacker could use this flaw to perform cross-site scripting attacks. | ||||||||||||||
| Alerts: |
| ||||||||||||||