# CVE-2023-7314: Nagios XI cross-site scripting in Bandwidth Report

Source: https://junglewise.ai/threats/cve-2023-7314-nagios-xi-cross-site-scripting-in-bandwidth-report  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-7314 · Severity: medium · CVSS 5.4 · Published 2025-10-30

Nagios XI is an enterprise monitoring solution used by organizations to track infrastructure health and performance. A cross-site scripting (XSS) vulnerability in its Bandwidth Report component allows attackers to inject malicious scripts that execute in users' browsers, potentially enabling session hijacking, credential theft, or unauthorized actions within the monitoring system.

Technologies: [Nagios XI](https://junglewise.ai/threats/technologies/xi). Vendors: [Nagios](https://junglewise.ai/threats/vendors/nagios).

## Quick answers

**Is CVE-2023-7314 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-7314 being exploited in the wild.

**How severe is CVE-2023-7314?** Medium severity, with a CVSS score of 5.4, published 30 October 2025.

**Which products and versions are affected?** Nagios XI prior to 5.11.3.

**Is there a fix for CVE-2023-7314?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2023-7314 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-7314?** Check whether you run Nagios XI or Nagios XI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reflected or stored cross-site scripting (XSS) flaw in the Bandwidth Report component of Nagios XI caused by insufficient validation and escaping of user-supplied input. An attacker can craft malicious input (typically via URL parameters or form fields in the report) that gets rendered without proper HTML/JavaScript encoding. When a victim accesses the malicious report link, the injected script executes in their browser context with the same privileges as the user. The vulnerability affects Nagios XI versions prior to 5.11.3, which introduced fixes for input sanitization and output encoding. An attacker needs network access to the Nagios XI web interface but does not require authentication to craft a malicious URL; however, victim interaction (clicking the link) is typically required for exploitation.

## Affected products

- Nagios XI prior to 5.11.3

## Timeline

- 2025-10-30: disclosed

## References

- [https://www.nagios.com/changelog/nagios-xi/](https://www.nagios.com/changelog/nagios-xi/)
- [https://www.nagios.com/products/security/](https://www.nagios.com/products/security/)

## Related threats

- [Nagios XI OS command injection in MIB upload](https://junglewise.ai/threats/cve-2026-119742-nagios-xi-before-2026r2-contains-an-os-command-injection)
- [Nagios XI insecure timing comparison in authentication](https://junglewise.ai/threats/cve-2023-24035-nagios-xi-insecure-timing-comparison-in-authentication)
- [Nagios XI open redirect in twilio_ajax_handler.php](https://junglewise.ai/threats/cve-2023-24034-nagios-xi-open-redirect-in-twilio-ajax-handler-php)
- [Nagios Core reflected cross-site scripting in cmd.cgi](https://junglewise.ai/threats/cve-2026-48550-nagios-core-reflected-cross-site-scripting-in-cmd-cgi)
- [In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user…](https://junglewise.ai/threats/cve-2025-67255-in-nagiosxi-2026r1-0-1-build-1762361101-dashboard-parameters-lack)