Security readout for executives and security teams
Plain-English summary
Older versions of Nagios XI, a popular IT monitoring platform, contain a flaw in the Core Config Manager that lets an authenticated user plant malicious script into object edit pages. When another user (often an administrator) views the affected page, the script runs in their browser and can hijack their session or actions inside the monitoring console.
Executive priority
Treat as a moderate-priority hygiene item: schedule the Nagios XI upgrade in the next standard maintenance window unless the console is broadly accessible or shared with less-trusted operators, in which case accelerate.
Technical view
Multiple stored/reflected XSS issues (CWE-79) exist in the Core Config Manager (CCM) object edit pages of Nagios XI before 5.7.4 (CCM < 3.0.7). Insufficient input validation and output encoding allow an authenticated low-privilege actor to inject script that executes in a victim's browser context. CVSS v4.0 base 5.1 (AV:N/AC:L/PR:L/UI:P) reflects authenticated injection requiring victim interaction with limited confidentiality/integrity impact on the subsequent component.
Likely exposure
Organizations running Nagios XI versions earlier than 5.7.4 with the Core Config Manager exposed to multiple internal users are most exposed. Risk concentrates where lower-privileged operators can submit object configurations later reviewed by administrators.
Exploitation context
No CISA KEV listing and no public reports of in-the-wild exploitation are cited in the source bundle. Exploitation requires authenticated access and victim interaction, which limits opportunistic abuse but is realistic in environments with multi-user CCM workflows or shared accounts.
Researcher notes
CVSS 4.0 vector indicates authenticated (PR:L) network-based injection requiring user interaction (UI:P) with subsequent-system low confidentiality/integrity impact, consistent with stored XSS pivoting against admin sessions. Affected-versions metadata in the bundle is sparse (defaultStatus "unaffected", versions ["0"]); rely on the vendor changelog and VulnCheck advisory to confirm the precise fixed build. No PoC, KEV entry, or exploit telemetry is cited.
Mitigation direction
- Upgrade Nagios XI to 5.7.4 or later (CCM 3.0.7+) per vendor changelog.
- Restrict CCM access to a minimal set of trusted operators.
- Place the Nagios XI web UI behind SSO and MFA to constrain attacker pivots.
- Apply a web application firewall rule set in front of the Nagios XI console.
- Review CCM audit logs for unexpected object edits by lower-privileged users.
Validation and detection
- Confirm installed Nagios XI and CCM versions against the 5.7.4 / 3.0.7 fix line.
- Inventory all Nagios XI instances, including non-production and lab deployments.
- Verify which user roles can author or edit CCM objects and tighten as needed.
- Check vendor changelog and VulnCheck advisory for any updated guidance.
- After patching, validate that object edit pages render user input safely in a controlled test.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-36860 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.1MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.nagios.com/changelog/nagios-xi/CVE reference · release-notes, patch
- https://www.vulncheck.com/advisories/nagios-xi-ccm-xss-via-object-edit-pagesCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.