Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-14006: Nagios XI allows crafted host header to spoof links

CVE-2024-14006 · published 1 year ago

Summary

Versions of Nagios XI before the 2024R1.2.2 update accept the HTTP Host header without proper checks. This lets an unauthenticated attacker send a fake header that changes the URLs the system creates, which could be used for phishing or hijacking password‑reset links. Upgrade to the latest version or apply the vendor's patch to validate the Host header.

What to do

Update nagios nagios_xi to version 2024 or later.
Update nagios xi to version 2024R1.2.2 or later.

Affected software

Vendor	Product	Affected versions
nagios	nagios_xi	< 2024 2024 `cpe:2.3:a:nagios:nagios_xi::::::::`
nagios	xi	< 2024R1.2.2

Original advisory text

Nagios XI < 2024R1.2.2 Host Header Injection

Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning.

References

https://www.nagios.com/changelog/nagios-xi/ Release Notes
https://www.nagios.com/products/security/#nagios-xi Vendor Advisory
https://www.vulncheck.com/advisories/nagios-xi-host-header-injection Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-346Origin Validation Error

Timeline

Published30 Oct 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-14006 · NVD

CVE-2024-14006 · MITRE

Track software like this

Free during beta