CVE-2023-51072: 
Nagios XI vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability exists in the NOC component of Nagios XI version up to and including 2024R1. The vulnerability was discovered and disclosed on December 18, 2023, affecting the Operation Center section of the application (NVD, CVE).

The vulnerability allows low-privileged users to execute malicious HTML or JavaScript code through the audio file upload functionality in the Operation Center section. The CVSS v3.1 base score is 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

When exploited, this vulnerability enables any authenticated user to execute arbitrary JavaScript code on behalf of other users, including administrators. This could potentially lead to unauthorized access, data theft, or further system compromise through administrator account manipulation (NVD).

The vulnerability requires authentication with low-level privileges and user interaction for successful exploitation. The attack vector is network-accessible, and the complexity of the attack is considered low according to the CVSS scoring (NVD).

Users should upgrade to a version newer than Nagios XI 2024R1. The vulnerability has been addressed in subsequent releases (Vendor Advisory).