CVE-2020-36862: Nagios XI < 5.6.11 Unauthenticated XSS and SSRF via Highcharts

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-30 · updated 2026-10-18
Weakness: CWE-79

Description

Nagios XI versions prior to 5.6.11 contain unauthenticated vulnerabilities in the Highcharts local exporting tool. Crafted export requests could (1) inject script into exported/returned content due to insufficient output encoding (XSS), and (2) cause the server to fetch attacker-specified URLs (SSRF), potentially accessing internal network resources. An unauthenticated remote attacker can leverage these issues to execute script in a user's browser when the exported content is viewed and to disclose sensitive information reachable from the export server via SSRF.

Affected products

Nagios XI: before 5.6.11 — fixed in 5.6.11

How to fix

Upgrade to a fixed version: Nagios XI 5.6.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-36862 or the next vulnerability affects your stack