Nagios XSS Flaw Allows Remote Execution of Arbitrary JavaScript

Nagios Enterprises today announced the general availability of Nagios XI 2024R2.1, the latest update to its flagship IT infrastructure monitoring platform.

This release delivers vital security hardening alongside new SNMP management capabilities designed to improve large-scale network monitoring and reporting.

Strengthened Security and License Management

One of the headline enhancements in 2024R2.1 is the closure of a cross-site scripting (XSS) vulnerability in the Graph Explorer feature, which could have allowed attackers to inject malicious scripts via certain URL parameters.

The Nagios XI team credited security researcher Marius Lihet for responsibly disclosing the issue.

In addition, the release adds support for new license levels, enabling more granular control over user permissions and feature access within large enterprise deployments.

The update also removes support for Ubuntu 20.04 due to its end-of-life status, ensuring that customers are running on up-to-date, supported operating systems.

Administrators will need to plan migrations accordingly to maintain platform security and receive future updates.

Expanded SNMP Functionality

Nagios XI 2024R2.1 significantly enhances SNMP-based monitoring workflows.

A new “SNMP Walk Jobs” page allows users to manage and execute SNMP walks independently from the Wizard interface, improving the scalability and reliability of large device audits.

Under the hood, the SNMP Walk Wizard has been updated to utilize jobs created by this new page, while step 2 of the wizard now supports MIB grouping and “select all” functionality for faster configuration of hundreds of OIDs.

In addition, administrators can now integrate Nagios Mod-Gearman to offload event processing and distributed checks, which helps large deployments maintain high performance under heavy loads.

The Nagios Core version bundled with this release has also been updated to 4.5.9, bringing the latest performance optimizations and stability improvements.

Table 1 highlights key changes in the Nagios XI 2024R2.1 release:

Category	Change	Notes
Security	XSS fix in Graph Explorer	Patched via CVE-style disclosure; researcher credited
License Management	Added support for new license levels	Granular feature access controls
Operating Systems	Removed Ubuntu 20.04 support	Migrating admins must plan OS upgrades
SNMP	New “SNMP Walk Jobs” page	Separate job dashboard for SNMP walk tasks
SNMP Wizard	MIB grouping and “select all” in step 2	Faster configuration of large OID sets
Integration	Added Nagios Mod-Gearman integration	Offload event processing for distributed checks
Core Bundle	Updated Nagios Core to 4.5.9	Latest performance and stability enhancements

Overview of Nagios XI 2024R2.1 key updates.

Administrators can download Nagios XI 2024R2.1 directly from Nagios Enterprises’ customer portal.

As with all Nagios XI releases, existing 2024R2 customers may apply the update via the web UI or CLI, while fresh installations can leverage the updated installation scripts.

Those still running Ubuntu 20.04 will need to move to Ubuntu 22.04 LTS or compatible Enterprise Linux distributions to continue receiving official support and patches.

With its focus on security, licensing flexibility, and robust SNMP audit capabilities, Nagios XI 2024R2.1 delivers essential enhancements for enterprises monitoring complex network environments.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates

The post Nagios XSS Flaw Allows Remote Execution of Arbitrary JavaScript appeared first on Cyber Security News.