CVE-2021-28924

This vulnerability is like leaving a sticky note on a shared web page that scripts into other people’s browsers. If someone is logged into Nagios Network Analyzer and they open the manipulated groups/queries page, the attacker’s code can run as that logged-in user in the browser.

This matters if you run Nagios Network Analyzer and users (admins or operators) browse the /nagiosna/groups/queries page while logged in. The issue is reachable in the default configuration for Nagios Network Analyzer before 2.4.2, but an attacker still needs a victim to click/open the crafted URL or input (user interaction). The risk is mainly “only after a user authenticated to the app visits the attacker’s page.”

Treat this as a high priority fix because there is a public exploit available and attackers can execute JavaScript inside an authenticated user’s browser session. While it requires a victim to open the crafted page, that is a common user interaction pattern and your users’ sessions can be abused. Update to the fixed version (2.4.3) as soon as possible.

1. Confirm exposure

• Identify your exact Nagios Network Analyzer version. This issue applies to “Nagios Network Analyzer before 2.4.2.”
• Confirm whether your admins/operators use the page at /nagiosna/groups/queries (the vulnerable page).

2. Upgrade remediation (primary fix)

• Upgrade Nagios Network Analyzer to 2.4.3.
• The vendor provides a change-log page for tracking related updates: https://www.nagios.com/downloads/nagios-network-analyzer/change-log/

3. Temporary workaround if you cannot upgrade right away

• Reduce the chance a logged-in user loads attacker-crafted content: restrict where admin browsers can access external links, and ensure users are not clicking unexpected URLs.
• If your deployment allows it, limit access to the Nagios Network Analyzer interface (especially the /nagiosna/groups/queries area) to trusted internal networks only.

4. After upgrading

• Re-check the deployed version matches 2.4.3.
• Watch for suspicious browser behavior on admin accounts (unexpected prompts, unexpected page actions) and review web access logs for unusual requests targeting /nagiosna/groups/queries.

5. Timing guidance

• Since this is fixed in 2.4.3, make the upgrade a near-term task for any environment on versions before 2.4.2.

Severity is moderate (CWE-79 Cross-Site Scripting). The weakness is a self-authenticated XSS on the /nagiosna/groups/queries page in Nagios Network Analyzer before 2.4.2: attacker-controlled content runs as unauthorized JavaScript in the context of the victim’s authenticated browser session (browser-side script execution). The findings indicate network-reachable impact, no attacker authentication requirement, but user interaction is required (a crafted URL or input must be visited). A public exploit is available, and press attention is rising; however, KEV is not listed for this CVE, so confirmed exploitation status via KEV is not established here. EPSS is given as 10.5% with a falling trend, but this is only predictive and not a substitute for patching.