# CVE-2023-7312: Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability when adding or…

Source: https://junglewise.ai/threats/cve-2023-7312-nagios-fusion-versions-prior-to-4-2-0-contain-a-stored-cross-site  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-30  
License: CC BY 4.0 with a link back

CVE-2023-7312 · Severity: medium · CVSS 4.8 · Published 2025-10-30

Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability when adding or configuring Email Settings. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affected page. An attacker who can add or modify SMTP/email settings or manipulate the sendmail configuration fields could persist a malicious payload that executes in the context of other users' browsers.

Technologies: [Nagios Fusion](https://junglewise.ai/threats/technologies/nagios-fusion). Vendors: [Nagios](https://junglewise.ai/threats/vendors/nagios).

## Quick answers

**Is CVE-2023-7312 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-7312 being exploited in the wild.

**How severe is CVE-2023-7312?** Medium severity, with a CVSS score of 4.8, published 30 October 2025.

**Which products and versions are affected?** Nagios Fusion. The advisory does not name versions.

**Is there a fix for CVE-2023-7312?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2023-7312?** Check whether you run Nagios Fusion. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Nagios Fusion

## Related threats

- [Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability in the LDAP/AD…](https://junglewise.ai/threats/cve-2023-53690-nagios-fusion-versions-prior-to-4-2-0-contain-a-stored-cross-site)
- [Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting (XSS) vulnerability in the license key…](https://junglewise.ai/threats/cve-2023-53689-nagios-fusion-versions-prior-to-4-2-0-contain-a-reflected-cross)
- [Nagios Fusion versions prior to 4.1.5 are vulnerable to cross-site scripting (XSS) via the "fusionwindow" parameter…](https://junglewise.ai/threats/cve-2018-25119-nagios-fusion-versions-prior-to-4-1-5-are-vulnerable-to-cross)
- [Nagios Fusion versions prior to 4.0.1 are vulnerable to cross-site scripting (XSS) via the Users and Servers pages…](https://junglewise.ai/threats/cve-2017-20209-nagios-fusion-versions-prior-to-4-0-1-are-vulnerable-to-cross)
- [A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to…](https://junglewise.ai/threats/cve-2025-60424-a-lack-of-rate-limiting-in-the-otp-verification-component-of)