Nagios XI Cross Site Scripting Vulnerability

[researcher]

Moderator Edit: This thread has been split from another - https://support.nagios.com/forum/viewto ... =6&t=34574
In the future, please create a new thread and link to the old one instead of adding on.

# Reflected XSS found on Nagios XI
example:
https://<target ip>/nagiosxi/login.php/hhbdq"-alert(1)-"napn9?redirect=/nagiosxi/index.php%3f&noauth=1

[tmcdonald]

# Reflected XSS found on Nagios XI
example:
https://<target ip>/nagiosxi/login.php/hhbdq"-alert(1)-"napn9?redirect=/nagiosxi/index.php%3f&noauth=1

For future reference, please send these reports to [email protected]

I am not able to reproduce this on the latest XI - What version were you testing against?