Nagios XI is prone to multiple cross-site request-forgery vulnerabilities because the application fails to properly validate HTTP requests. Successful exploit requires that the 'nagiosadmin' be logged into the web interface. Attackers can exploit these issues to gain unauthorized access to the affected application and perform certain administrative actions. Nagios XI 2009R1.2B is vulnerable other versions may also be affected.

Reportedly, these issues have been fixed in Nagios XI 2009R1.2C. Please see the references for more information.

• http://www.nagios.com/products/nagiosxi
• https://www.securityfocus.com/bid/42322

---

Updated on 2017-03-28