CVE-2022-38248

What it actually does

Multiple cross-site scripting flaws in auditlog.php allow injection of attacker-controlled scripts into pages viewed by Nagios XI users.

Why it matters to the business

Attackers could hijack administrator sessions, steal monitoring data, or perform unauthorized actions within the organization's IT infrastructure oversight tools.

How an attack unfolds

An attacker supplies malicious script content through inputs that reach the audit log, then waits for or tricks an administrator into viewing the affected auditlog.php page where the script executes in the browser context.

How to fix it

Upgrade Nagios XI to version 5.8.7 or later to apply input sanitization fixes for auditlog.php.

How to confirm the fix worked

Confirm the installed Nagios XI version is 5.8.7 or newer; inspect auditlog.php source for proper output encoding of logged data.

Typical attack path

1. Identify inputs or parameters that populate the audit log
2. Craft and submit a request containing script payloads
3. Ensure an administrator accesses auditlog.php
4. Script executes to exfiltrate cookies or perform actions

How to detect it

Examine web server access logs for requests to auditlog.php containing unusual parameters or encoded script indicators; review Nagios audit logs for anomalous entries that coincide with administrative logins.

What your security team should do

• Upgrade Nagios XI to 5.8.7 or later immediately
• Review and restrict access to auditlog.php where possible
• Enable web application firewall rules to block common script patterns targeting monitoring interfaces
• Monitor for unusual administrator session behavior