CVE-2023-53688: Nagios XI < 5.11.3 XSS & CSRF via Hypermap Replay

Vulnerability summary

CVE-2023-53688 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in nagios nagios_xi. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.4% of scored vulnerabilities.

Timeline

1. 30-10-2025
   PublishedVulnerability first disclosed.
2. 17-11-2025
   Last modifiedVulnerability information updated.

Description

Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) and cross-site request forgery (CSRF) via the Hypermap Replay component. An attacker can submit crafted input that is not properly validated or escaped, allowing injection of malicious script that executes in the context of a victim's browser (XSS). Additionally, the component does not enforce sufficient anti-CSRF protections on state-changing operations, enabling an attacker to induce authenticated users to perform unwanted actions.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.