Medium severity6.1NVD Advisory· Published Oct 30, 2025· Updated Jun 17, 2026
CVE-2024-14006
CVE-2024-14006
Description
Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
14- Nagios/XIv5Range: 0
cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*+ 12 more
- cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*range: <2024
- cpe:2.3:a:nagios:nagios_xi:2024:r1:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.0.1:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.0.2:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.1:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.1.1:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.1.2:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.1.3:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.1.4:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.1.5:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.2:*:*:*:*:*:*
- cpe:2.3:a:nagios:nagios_xi:2024:r1.2.1:*:*:*:*:*:*
- (no CPE)range: <2024R1.2.2
Patches
Vulnerability mechanics
References
3- www.nagios.com/products/security/nvdVendor Advisory
- www.vulncheck.com/advisories/nagios-xi-host-header-injectionnvdThird Party Advisory
- www.nagios.com/changelog/nagios-xi/nvdRelease Notes
News mentions
0No linked articles in our index yet.