Security readout for executives and security teams
Plain-English summary
Older versions of Nagios XI's Core Config Manager let an authenticated user paste malicious code into service configuration fields. When another user views the affected page, that code runs in their browser and can hijack their session or trick them into unwanted actions. Nagios fixed this in XI 5.8.2 (CCM 3.1.1).
Executive priority
Moderate priority. This is a browser-side flaw requiring an authenticated insider to plant the payload, so business impact is limited unless your Nagios XI console is widely accessible. Schedule the upgrade in the next routine patch window and confirm administrative access is appropriately scoped.
Technical view
Stored cross-site scripting (CWE-79) exists in the Nagios XI Core Config Manager Services page. The config_name and service_description fields fail to properly validate or escape user input before rendering, allowing an authenticated low-privileged attacker to persist script payloads that execute in a victim's browser when the page is viewed. Fixed in CCM 3.1.1 / Nagios XI 5.8.2.
Likely exposure
Affects Nagios XI deployments running CCM versions prior to 3.1.1 (Nagios XI < 5.8.2). Internet-exposed Nagios XI consoles with multiple operators or admins are at greater risk; isolated, single-user, or already-patched instances have minimal exposure. Requires authenticated CCM access to plant the payload.
Exploitation context
Not listed in CISA KEV and no public reports of active exploitation are cited in the source bundle. CVSS 4.0 base score is 5.1 with attack vector Network, low complexity, low privileges required, and user interaction (Passive). Impact is confined to confidentiality/integrity of the subsequent (browser) scope.
Researcher notes
Stored XSS in CCM Services page fields (config_name, service_description). CVSS 4.0 vector indicates passive UI requirement and changed scope (SC:L/SI:L), consistent with payload execution in a victim admin's session. No CPE list provided in the bundle; affected version range is "prior to CCM 3.1.1 / Nagios XI 5.8.2". Published 2025-10-30 despite the 2021 CVE ID — likely a backfilled disclosure. Validate fix by reviewing vendor changelog entry for 5.8.2.
Mitigation direction
- Upgrade Nagios XI to 5.8.2 or later (CCM 3.1.1+) per vendor changelog.
- Restrict CCM access to trusted administrators and enforce least privilege.
- Place the Nagios XI console behind VPN or IP allowlisting where feasible.
- Review and sanitize existing service configuration entries for unexpected script content.
- Monitor vendor advisories for additional XSS hardening guidance.
Validation and detection
- Check Nagios XI version via Admin > System Information; confirm >= 5.8.2.
- Verify CCM (Core Config Manager) component version is 3.1.1 or newer.
- Audit service configurations for anomalous content in config_name and service_description fields.
- Review web server and application logs for suspicious POSTs to CCM Services endpoints.
- Confirm CCM access is limited to authenticated, authorized users only.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47691 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.1MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.nagios.com/changelog/nagios-xi/CVE reference · release-notes, patch
- https://www.vulncheck.com/advisories/nagios-xi-ccm-xss-via-services-pageCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.