Description
An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect vulnerability.
Published: 2026-09-14
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Open Redirect
Action: Apply Patch
AI Analysis

Impact

An open redirect flaw in the twilio_ajax_handler.php script of Nagios XI allows an attacker to force a user to visit a malicious site by supplying a crafted redirect URL. The vulnerability is classified as CWE‑601. Based on the description, it is inferred that this redirect can be used to trick users into clicking malicious links, trusted interface.

Affected Systems

Nagios XI systems running any version before 5.9.3 are affected. The vulnerability exists in the twilio_ajax_handler.php component of Nagios XI.

Risk and Exploitability

The CVSS score of 3.1 indicates low severity, and the EPSS score of <1% reflects a very low exploitation probability. Based on the description, it is inferred that the flaw does not require authentication or elevated privileges, and the attack path relies on user interaction to trigger the redirect. The vulnerability is not listed in the CISA KEV catalog, so no known active exploitation is documented.

Generated by OpenCVE AI on September 15, 2026 at 15:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Nagios XI 5.9.3 or later, which contains a fix for the open redirect bug.
  • Restrict the redirect target URLs to a whitelist of trusted domains or enforce same‑origin checks in the redirection logic.
  • Monitor user traffic for anomalous redirect attempts and educate users about the risk of unexpected redirects.

Generated by OpenCVE AI on September 15, 2026 at 15:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 16:15:00 +0000

Type Values Removed Values Added
Title Open Redirect Vulnerability in Nagios XI Twilio AJAX Handler

Mon, 14 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Title Open Redirect Vulnerability in Nagios XI twilio_ajax_handler.php

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 14 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Title Open Redirect Vulnerability in Nagios XI twilio_ajax_handler.php

Mon, 14 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Nagios xi
Vendors & Products Nagios xi

Mon, 14 Sep 2026 04:00:00 +0000

Type Values Removed Values Added
Description An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect vulnerability.
First Time appeared Nagios
Nagios nagios Xi
Weaknesses CWE-601
CPEs cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*
Vendors & Products Nagios
Nagios nagios Xi
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

Nagios Nagios Xi Xi
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-14T15:15:31.305Z

Reserved: 2023-01-21T00:00:00.000Z

Link: CVE-2023-24034

cve-icon Vulnrichment

Updated: 2026-09-14T15:15:27.990Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-14T04:16:35.107

Modified: 2026-09-22T19:56:19.073

Link: CVE-2023-24034

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T16:00:17Z

Weaknesses
  • CWE-601

    URL Redirection to Untrusted Site ('Open Redirect')