Skip to content
CVE Tracker
Back

CVE-2011-10037

Nagios XI < 2011R1.9 XSS via xiwindow Variables Affecting Permalinks

Medium5.1EPSS 0.61%
Published
Updated
Reserved
Assigned by
VulnCheck

Description

Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling of xiwindow variables used to build permalinks in the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Scores

CVSS scores of CVE-2011-10037, by who scored it
Scored byCVSSScoreVector
VulnCheckCNA (assigner)4.0Medium5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
NVDNVD · Modified4.0Medium5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.61% · top 51% of all CVEs (2 Nov 2026)
CISA SSVC
Exploitation: poc · Automatable: no · Technical impact: partial

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.

Weakness

Affected products

  • Nagios · XI

    • affected < 2011R1.9

What to do

Solution: Nagios addresses this vulnerability as "Fixed XSS vulnerability in xiwindow variables (affected permalinks)."

References (3)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .