Description
An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect vulnerability.
Published: 2026-09-14
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Open Redirect
Action: Apply Patch
AI Analysis

Impact

An open redirect flaw in twilio_ajax_handler.php allows an attacker to force a user to visit a malicious site by supplying a crafted redirect URL. The weakness is CWE-601, which can be used for phishing or credential leakage by tricking users into following a link that appears to come from the trusted Nagios XI interface.

Affected Systems

Nagios XI systems running any version before 5.9.3 are affected. The vulnerability exists in the tjwilio_ajax_handler.php component of Nagios XI.

Risk and Exploitability

The CVSS score of 3.1 reflects the low severity of this flaw, and the EPSS score is not available, indicating limited known exploitation activity. The vulnerability does not require authentication or elevated privileges, and the attack path relies on user interaction to trigger the redirect. As it is not listed in CISA KEV, it is not known to be actively exploited in known campaigns.

Generated by OpenCVE AI on September 14, 2026 at 11:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Nagios XI 5.9.3 or later, which contains a fix for the open redirect bug.
  • Restrict the redirect target URLs to a whitelist of trusted domains or enforce same‑origin checks in the redirection logic.
  • Monitor user traffic for anomalous redirect attempts and educate users about the risk of unexpected redirects.

Generated by OpenCVE AI on September 14, 2026 at 11:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Title Open Redirect Vulnerability in Nagios XI twilio_ajax_handler.php

Mon, 14 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Nagios xi
Vendors & Products Nagios xi

Mon, 14 Sep 2026 04:00:00 +0000

Type Values Removed Values Added
Description An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect vulnerability.
First Time appeared Nagios
Nagios nagios Xi
Weaknesses CWE-601
CPEs cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*
Vendors & Products Nagios
Nagios nagios Xi
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

Nagios Nagios Xi Xi
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-14T03:45:18.360Z

Reserved: 2023-01-21T00:00:00.000Z

Link: CVE-2023-24034

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-14T04:16:35.107

Modified: 2026-09-14T04:16:35.107

Link: CVE-2023-24034

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-14T11:30:08Z

Weaknesses
  • CWE-601

    URL Redirection to Untrusted Site ('Open Redirect')