Security readout for executives and security teams
Plain-English summary
Older versions of Nagios XI, a popular IT monitoring platform, contain a flaw in the Reports section that lets an attacker sneak malicious code into a webpage through date fields. If a logged-in user is tricked into clicking a crafted link, the code runs in their browser and could steal session data or trigger unwanted actions inside the monitoring console.
Executive priority
Schedule as routine patch hygiene unless a legacy Nagios XI server is internet-exposed; in that case prioritize upgrade within the next maintenance window. Business impact is limited but reputationally relevant if monitoring operators are phished.
Technical view
Nagios XI versions prior to 5.2.4 fail to properly validate or escape the startdate and enddate parameters in the Reports interface, enabling reflected cross-site scripting (CWE-79). An authenticated low-privileged user can deliver a crafted URL that executes arbitrary JavaScript in the victim's browser context, with potential impact to confidentiality and integrity of the rendered application content.
Likely exposure
Limited to organizations still running Nagios XI builds older than 5.2.4 with the Reports module accessible to authenticated users. Modern, patched deployments are not affected. Internet-exposed legacy instances increase the risk of targeted phishing against monitoring operators.
Exploitation context
No active exploitation is reported in the provided sources, and the issue is not listed in CISA KEV. Exploitation requires an authenticated session plus user interaction (clicking a crafted link), and CVSS 4.0 scores impact as low/limited per the supplied vector.
Researcher notes
Reflected XSS in startdate/enddate of the Reports interface; CWE-79, CVSS 4.0 base 5.1 with PR:L and UI:P. CVE was published in 2025 for a vulnerability fixed in Nagios XI 5.2.4. Validate by reviewing Nagios XI release notes and the VulnCheck advisory; no public PoC is referenced in the supplied bundle.
Mitigation direction
- Upgrade Nagios XI to version 5.2.4 or later per vendor changelog.
- Restrict Reports module access to trusted, authenticated administrators only.
- Enforce a strict Content Security Policy on the Nagios XI front end.
- Train operators to avoid clicking untrusted links into the monitoring console.
- Place the Nagios XI UI behind VPN or SSO with MFA to limit attacker reach.
Validation and detection
- Identify the running Nagios XI version via the admin console or product banner.
- Compare the version against vendor changelog entries for 5.2.4 and above.
- Review web server and application logs for suspicious startdate/enddate parameter values.
- Test report URLs in a controlled environment to confirm input encoding behavior.
- Confirm patch status with the Nagios XI maintainer or support contract.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2016-15051 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.1MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.nagios.com/changelog/nagios-xi/CVE reference · release-notes, patch
- https://www.vulncheck.com/advisories/nagios-xi-xss-via-report-startdate-enddate-fieldsCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.