CVE-2011-2179 EXPLOIT
4.3
MEDIUM · CVSS 2.0 · EPSS 26% (pctl 98)
Patch early
A public exploit exists.
Description
Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an (a) command action or a (b) hosts action.
Scoring
| CVSS | 4.3 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| EPSS | 26.04% — more likely to be exploited than 98% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2011-06-14 |
| Last modified | 2026-06-16 |
Affected (2)
| Vendor | Product |
|---|---|
| icinga | icinga |
| nagios | nagios |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Nagios 3.2.3 - 'expand' Cross-Site Scripting | 2011-06-01 |
References
- http://archives.neohapsis.com/archives/bugtraq/2011-06/0017.html
- http://archives.neohapsis.com/archives/bugtraq/2011-06/0018.html
- http://secunia.com/advisories/44974
- http://securityreason.com/securityalert/8274
- http://tracker.nagios.org/view.php?id=224
- http://www.openwall.com/lists/oss-security/2011/06/01/10
- http://www.openwall.com/lists/oss-security/2011/06/02/6
- http://www.rul3z.de/advisories/SSCHADV2011-005.txt
- http://www.rul3z.de/advisories/SSCHADV2011-006.txt
- http://www.securityfocus.com/bid/48087
- http://www.ubuntu.com/usn/USN-1151-1
- https://bugzilla.redhat.com/show_bug.cgi?id=709871
- https://dev.icinga.org/issues/1605
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67797
- http://archives.neohapsis.com/archives/bugtraq/2011-06/0017.html
- http://archives.neohapsis.com/archives/bugtraq/2011-06/0018.html
- http://secunia.com/advisories/44974
- http://securityreason.com/securityalert/8274
- http://tracker.nagios.org/view.php?id=224
- http://www.openwall.com/lists/oss-security/2011/06/01/10
→ the Explorer · watch your stack · NVD