Security readout for executives and security teams
Plain-English summary
Older versions of Nagios XI, a popular IT monitoring platform, contain a stored cross-site scripting flaw on the "My Tools" page. A logged-in user can plant malicious script content that runs later in another user's browser session, potentially hijacking their Nagios session or tricking them into unwanted actions inside the console.
Executive priority
Treat as a routine patching item, not an emergency. Risk concentrates where Nagios XI is exposed beyond the operations team or where many users share the console. Schedule the upgrade within the normal monthly maintenance window unless the console is internet-facing, in which case accelerate it.
Technical view
Nagios XI prior to 5.8.0 fails to properly validate or escape input on the My Tools page, leading to stored XSS (CWE-79). Per CVSS 4.0 vector AV:N/AC:L/PR:L/UI:P, exploitation requires an authenticated low-privilege account and victim interaction. Impact is limited to the browser context (SC:L/SI:L), not the underlying host. The issue was remediated in Nagios XI 5.8.0.
Likely exposure
Affects organizations still running Nagios XI versions earlier than 5.8.0, especially internet-exposed monitoring portals or multi-tenant deployments where lower-privileged operators can store content viewable by administrators. On-prem-only consoles with strict access reduce exposure but do not eliminate it.
Exploitation context
No public reports of active exploitation and the CVE is not listed in CISA KEV. Realistic abuse path is an authenticated insider or compromised low-privilege account injecting script that fires when an admin views the page, enabling session theft or pivoting within the Nagios UI. No public PoC is referenced in the bundle.
Researcher notes
CVSS 4.0 5.1 reflects authenticated, user-interactive stored XSS with limited subsequent-system impact. CWE-79 with PR:L and UI:P aligns with admin-targeted phishing-via-UI scenarios. The CVE was published in 2025 for a fix shipped in 5.8.0; verify exact fix commit via Nagios changelog and corroborate with the VulnCheck advisory before scoping detection rules.
Mitigation direction
- Upgrade Nagios XI to 5.8.0 or later per vendor changelog.
- Restrict Nagios XI console access to trusted networks and named users.
- Review and minimize accounts that can author content on the My Tools page.
- Enforce least privilege and re-validate role assignments for operators.
- Front the console with a WAF tuned to block stored XSS payloads.
Validation and detection
- Inventory every Nagios XI instance and record its exact version.
- Confirm any instance below 5.8.0 is scheduled for upgrade or isolation.
- After upgrade, verify version reported in the admin UI matches 5.8.0+.
- Audit My Tools page entries for unexpected HTML or script content.
- Review web and authentication logs for anomalous admin sessions on the console.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47695 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.1MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.nagios.com/changelog/nagios-xi/CVE reference · release-notes, patch
- https://www.vulncheck.com/advisories/nagios-xi-xss-via-my-tools-pageCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.