CVE-2024-14006 — Nagios XI < 2024R1.2.2 Host Header Injection
Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs w…
Published: 2025-10-30 · CVSS: 8.8 · CVSS 4.0
Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7