{"id":"CVE-2015-8010","aliases":["EUVD-2015-7906","GHSA-x57r-7jqf-5w9p","SUSE-SU-2018:3620-1","UBUNTU-CVE-2015-8010"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and...","description":"Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01486,"percentile":0.74223,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2017-03-27T17:00:00Z","modified":"2026-06-17T00:33:52Z","affected":[{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"icinga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.3-12.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"icinga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.3-12.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"icinga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.3-1","1.13.3-2","1.13.3-2ubuntu0.1"]}],"products":[{"vendor":"icinga","product":"icinga"},{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse_project","product":"leap"}],"references":[{"url":"https://github.com/Icinga/icinga-core/issues/1563","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/10/29/15","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00019.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/97145","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2015/10/23/15","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8010"},{"url":"https://github.com/advisories/GHSA-x57r-7jqf-5w9p"},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183620-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1011630","tags":["report"]},{"url":"https://bugzilla.suse.com/1018047","tags":["report"]},{"url":"https://bugzilla.suse.com/952777","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8641","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-8010","tags":["report"]},{"url":"https://dev.icinga.org/issues/10453","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8010","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-8010","description":"Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi.","status":"published","published":"2017-03-27T17:00:00Z","modified":"2024-08-06T08:06:31.609Z","updated_at":"2026-11-02T14:35:41.26549Z"}],"euvd":[{"id":"EUVD-2015-7906","description":"Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi.","status":"published","published":"2017-03-27T17:00:00Z","modified":"2024-08-06T08:06:31Z","updated_at":"2026-11-03T02:21:50.339607Z"}],"ghsa":[{"id":"GHSA-x57r-7jqf-5w9p","title":"Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and...","description":"Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi.","status":"published","published":"2022-05-14T02:11:46Z","modified":"2023-02-02T05:05:19Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:52:04.117158Z"}],"nvd":[{"id":"CVE-2015-8010","description":"Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi.","status":"published","published":"2017-03-27T17:59:00.257Z","modified":"2026-06-17T00:33:52.05Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:17.368799Z"}],"osv":[{"id":"UBUNTU-CVE-2015-8010","description":"Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi.","status":"published","published":"2017-03-27T17:59:00Z","modified":"2025-10-24T04:45:29Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:10.737723Z"},{"id":"SUSE-SU-2018:3620-1","title":"Security update for icinga","description":"This update for icinga fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2015-8010: Fixed XSS in the icinga classic UI (boo#952777)\n- CVE-2016-8641 / CVE-2016-10089: fixed a possible symlink attack for files/dirs created by root (boo#1011630 and boo#1018047)\n\n","status":"published","published":"2018-11-05T16:57:03Z","modified":"2026-02-04T03:50:12.730269Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}