CVE-2018-15712: Nagios XI api_tool.php host parameter reflected XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

medium priorityReflected XSS requires user interaction and yields limited direct impact, but unauthenticated reachability and public exploit code raise the practical risk.

What it is

Nagios XI 5.5.6 reflects the host parameter in api_tool.php without proper output encoding, allowing reflected cross-site scripting. Because the endpoint is reachable without authentication, an attacker can craft a link that runs script in a victim's browser in the context of the Nagios XI site.

Impact

An attacker can execute arbitrary script in a victim's browser session, potentially stealing session cookies or performing actions as the victim within Nagios XI. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network via a crafted URL to api_tool.php with a malicious host parameter; no authentication is required, but the victim must click the link (UI:R).

Exploitation

Not listed in CISA KEV, but EPSS is high (0.48555, 98.8th percentile) and both references are tagged Exploit, indicating public exploit code exists.

What to do

• Upgrade Nagios XI past 5.5.6 to a version that encodes the host parameter in api_tool.php.
• If immediate upgrade is not possible, restrict network access to api_tool.php to trusted management networks.
• Deploy a WAF rule to block script payloads in the host parameter of api_tool.php.
• Enforce HttpOnly and Secure flags on Nagios XI session cookies to limit cookie theft.
• Audit logs for requests to api_tool.php with suspicious host parameter values.

Detection

• Search web/proxy logs for requests to api_tool.php with script tags or event handlers in the host parameter.
• Alert on outbound or inline script content in responses from api_tool.php.
• Monitor for unusual referrer or URL patterns containing encoded script in the host parameter.
• Review Nagios XI access logs for repeated api_tool.php requests from a single source.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.