CVE-2024-14006 | BDVDB-2026-300138 Detail

Description#

Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-10-30Record published in the CVE List.
2. Version 22026-09-30Most recent update recorded in the CVE List.