What’s Vulnerable › Vulnerabilities

CVE-2023-53689: Nagios Fusion < 4.2.0 License Information Reflected XSS

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-30 · updated 2026-10-18
• Weakness: CWE-79

Description

Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting (XSS) vulnerability in the license key configuration flow that can result in execution of attacker-controlled script in the browser of a user who follows a crafted URL. While the application server itself is not directly corrupted by the reflected XSS, the resulting browser compromise can lead to credential/session theft and unauthorized administrative actions.

Affected products

• Nagios Fusion: before 4.2.0 — fixed in 4.2.0

How to fix

Upgrade to a fixed version: Nagios Fusion 4.2.0. Check the vendor advisory for mitigations.

References

• https://www.nagios.com/changelog/nagios-fusion/
• https://www.nagios.com/products/security/#fusion
• https://www.vulncheck.com/advisories/nagios-fusion-license-information-reflected-xss

Get alerted when CVE-2023-53689 or the next vulnerability affects your stack