CVE-2023-7312 Details
Description
Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability when adding or configuring Email Settings. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affected page. An attacker who can add or modify SMTP/email settings or manipulate the sendmail configuration fields could persist a malicious payload that executes in the context of other users' browsers.
A stored cross-site scripting vulnerability has been identified in Nagios Fusion versions prior to 4.2.0. This issue arises when users add or configure email settings, as unsanitized input can be saved and later displayed in the administrative interface. This allows JavaScript to execute in the browsers of users who view the affected page. An attacker with the ability to modify SMTP or sendmail configuration fields could inject a malicious payload that executes in the context of other users' browsers.
Users are advised to upgrade to Nagios Fusion version 4.2.0 or higher.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 3, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.nagios.com/changelog/nagios-fusion/ | [email protected] | Product |
| https://www.nagios.com/products/security/#fusion | [email protected] | Vendor Advisory |
| https://www.vulncheck.com/advisories/nagios-fusion-email-settings-stored-xss-via-smtp-sendmail | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nagios fusion | < 4.2.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 6, 2025 | Initial Analysis | [email protected] |
| Oct 30, 2025 | New CVE Received | [email protected] |