Quick answers
- Is CVE-2023-24034 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2023-24034 being exploited in the wild.
- How severe is CVE-2023-24034?
- Low severity, with a CVSS score of 3.1, published 14 September 2026.
- Which products and versions are affected?
- Nagios XI before 5.9.3.
- Is there a fix for CVE-2023-24034?
- A patch was published on 2023: Fixed in Nagios XI 5.9.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2023-24034 attacked?
- It is attacked over the network.
- Am I affected by CVE-2023-24034?
- Check whether you run Nagios XI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An open redirect vulnerability exists in twilio_ajax_handler.php in Nagios XI before version 5.9.3. The vulnerability allows an attacker to craft a malicious URL that, when visited by a user, redirects them to an arbitrary attacker-controlled website. This is a client-side redirect that relies on user interaction (clicking a link) and does not require authentication to trigger. The attack vector is network-based, typically leveraging phishing or social engineering to deliver the malicious link. No remote code execution or direct system compromise occurs, but the redirect can facilitate credential theft or malware distribution.
Affected products
- Nagios Nagios XI before 5.9.3
Timeline
- 2026-09-14: disclosed
- 2023: patched: Fixed in Nagios XI 5.9.3