CVE-2020-27990: 
Nagios XI vulnerability analysis and mitigation

Nagios XI before version 5.7.5 is vulnerable to Cross-Site Scripting (XSS) in the Deployment tool (add agent) functionality (Nagios Changelog, NVD). This vulnerability was disclosed on November 16, 2020.

The vulnerability is classified as a Cross-Site Scripting (XSS) issue with a CVSS v3.1 Base Score of 5.4 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The vulnerability exists in the Deployment tool, specifically in the add agent functionality, where input is not properly sanitized before being displayed to users (NVD).

If exploited, this vulnerability could allow an attacker to execute arbitrary web scripts or HTML in the context of other users' browsers who access the affected Deployment tool. This could lead to theft of sensitive information, session hijacking, or other client-side attacks (NVD).

The vulnerability requires an authenticated user with access to the Deployment tool to exploit. The attack complexity is low, but user interaction is required for successful exploitation (NVD).

The vulnerability has been fixed in Nagios XI version 5.7.5. Users are advised to upgrade to this version or later to mitigate the risk (Nagios Changelog).