← Vulnerability feed

Vulnerability record · CVE-2011-2179 · published 14 June 2011

CVE-2011-2179: Icinga cross-site scripting vulnerability

Icinga · Icinga

Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an (a) command action or a (b) hosts action.

4.3 CVSS 2.0 Medium EPSS 26% · top 2.1% CWE-79 · Cross-site scripting
4.3CVSS 2.0 base score
26%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
28References, 10 tagged exploit
16 Jun 2026Last modified by NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an (a) command action or a (b) hosts action.

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://archives.neohapsis.com/archives/bugtraq/2011-06/0017.html
http://archives.neohapsis.com/archives/bugtraq/2011-06/0018.html ExploitPatch
http://secunia.com/advisories/44974
http://securityreason.com/securityalert/8274
http://tracker.nagios.org/view.php?id=224 ExploitPatchVendor Advisory
http://www.openwall.com/lists/oss-security/2011/06/01/10
http://www.openwall.com/lists/oss-security/2011/06/02/6
http://www.rul3z.de/advisories/SSCHADV2011-005.txt ExploitPatch
http://www.rul3z.de/advisories/SSCHADV2011-006.txt ExploitPatch
http://www.securityfocus.com/bid/48087
http://www.ubuntu.com/usn/USN-1151-1
https://bugzilla.redhat.com/show_bug.cgi?id=709871
https://dev.icinga.org/issues/1605 ExploitPatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/67797
http://archives.neohapsis.com/archives/bugtraq/2011-06/0017.html
http://archives.neohapsis.com/archives/bugtraq/2011-06/0018.html ExploitPatch
http://secunia.com/advisories/44974
http://securityreason.com/securityalert/8274
http://tracker.nagios.org/view.php?id=224 ExploitPatchVendor Advisory
http://www.openwall.com/lists/oss-security/2011/06/01/10
http://www.openwall.com/lists/oss-security/2011/06/02/6
http://www.rul3z.de/advisories/SSCHADV2011-005.txt ExploitPatch
http://www.rul3z.de/advisories/SSCHADV2011-006.txt ExploitPatch
http://www.securityfocus.com/bid/48087
http://www.ubuntu.com/usn/USN-1151-1
https://bugzilla.redhat.com/show_bug.cgi?id=709871
https://dev.icinga.org/issues/1605 ExploitPatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/67797

Track CVE-2011-2179 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-4796Snoopy project snoopy os command injection vulnerabilityThe _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamat…EPSS 9.0%10.0CVE-2002-1959Nagios vulnerabilityNagios 1.0b1 through 1.0b3 allows remote attackers to execute arbitrary commands via shell metacharacters in plugin output.EPSS 3.9%9.8CVE-2024-49369Icinga improper certificate validation vulnerabilityIcinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for repor…EPSS 2.9%9.8CVE-2016-0726Nagios hard-coded credentials vulnerabilityThe Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for remote at…EPSS 2.3%9.8CVE-2008-7313Snoopy command injection vulnerabilityThe _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands. NOTE: this issue exists dues to an incomplete fix for CVE…EPSS 4.5%9.8CVE-2014-5009Snoopy command injection vulnerabilitySnoopy allows remote attackers to execute arbitrary commands. NOTE: this vulnerability exists due to an incomplete fix for CVE-2014-5008.EPSS 4.7%9.8CVE-2016-9565Nagios improper access control vulnerabilityMagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofin…EPSS 23%9.3CVE-2025-48057Icinga vulnerabilityIcinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for rep…EPSS 0.44%

Source: NIST National Vulnerability Database (record CVE-2011-2179), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.