Nagios XI Changelog

Nagios XI 2024R1.3.1

Security

  • Fixed a security vulnerability in history content tab (Thanks to Ruben Meeuwissen for reporting this) [GL:XI#1338] – DA
  • Fixed Neptune Tools allowing protocols other than HTTP and HTTPS (Thanks to Ruben Meeuwissen for reporting this) [GL:XI#1325] – DA
  • Fixed user enumeration vulnerability in deprecated backend API (Thanks to Ruben Meeuwissen for reporting this) [GL:XI#1326] – DA
  • Added host header verification option in security settings [GL:XI#1334] – DA

Removed

  • Removed the ability for read only users to add their own tools (Thanks to Ruben Meeuwissen for reporting this) [GL:XI#1324] – DA
  • Removed exclusion of net-snmp package on RHEL/Oracle 8 systems [GL:XI#1066] – SG
  • Removed superfluous links from Capacity Planning graphs – CN

Added

  • Added CSRF protection to favorites component (Thanks to Ruben Meeuwissen for reporting this) [GL:XI#1339] – DA
  • Added the ability to set TDS version in MSSQL Wizards and plugin. [XI:#1288] – CN,SG
  • Added NCPA 3 support in Ansible roles for the Deploy Agent feature. [GL:XI!1106] – MPB

Fixed

  • Cleaned up upgrade scripts [GL:XI!1121] – DA,BB
  • Cleaned up many PHP warnings displayed in logs across the application [GL:XI#1345] – JS
  • Fixed an issue where custom includes were not applied correctly in Neptune themes [GL:XI#1313] – SG
  • Fixed an issue where updating contacts created by template in the CCM could sometimes fail [GL:XI#1333] – JS
  • Fixed some checkboxes and UI interactions throughout the Neptune theme [GL:XI!1134] – DA
  • Fixed upgrade scripts in the case where the installtype variable isn’t determined. [GL#1352] – JM
  • Updated checking of xi-itype file during upgrades [GL:XI!1132] – DA
  • Updated Neptune Network Error Handling [GL:XI!1111] – DA
  • Updated styling for dialogs and fixed a variety of small errors with the Neptune theme [GL:XI!1128] – DA

Nagios XI 2024R1.3

Security

  • Fixed an issue with external help resource links opening in current window instead of a new tab [GL:XI#916] – GW

Updated

  • Updated Alert History Dashlet to correctly reflect the current theme [GL:XI#1145] – GW
  • Updated birdseye to choose dark mode when theme is set to Neptune [GL:XI#1197] – GW
  • Updated deployment script to install the Nagios repo’s GPG key to resolve deployment errors [GL:XI#947] – BB
  • Updated the UI in the Local Backup Archives and Manage Views pages [GL:XI#893] – GW

Added

  • Added check for NEB modules before upgrading [GL:XI#1307] – DA
  • Added enter functionality to Neptune search and improved search results [GL:XI#1190] – DA
  • Added graphs to Network Reports [GL:XI#413] – DA
  • Added support for Debian 12 [GL:XI#576] – AC
  • Added the ability to set TDS version to support different version of MS SQL [XI:#1288] – CN

Fixed

  • Fixed an issue where a plugin for the Network Switch / Router Wizard was not being copied to the correct directory on install & upgrade [GL:XI#1280] – CN
  • Fixed an issue where some Wizards did not display saved templates [GL:XI#580] – GW
  • Fixed an issue where systems without the xi-itype file could not upgrade [GL:XI#1315] – DA
  • Fixed an issue where users could encounter a broken page with SQL errors when adding custom variables [GL:XI#605] – GW
  • Fixed an issue with a link in the service status details page redirecting to the current page [GL:XI#1140] – GW
  • Fixed an issue with broken buttons in graph context menus in Graph Explorer – CN
  • Fixed custom includes not reflecting edits in the interface without refreshing the page [GL:XI#1231] – GW
  • Fixed Modern Gauge Dashlet title and toggle [GL:XI#733] – GW,DA
  • Fixed PHP warnings and search functionality and made a UI improvement on MRTG File Management page [GL:XI#1233] – GW
  • Fixed service names incorrectly being converted to lowercase [GL:XI#1248] – GW
  • Fixed three instances of links being shown to unauthorized users [GL:XI#1102,1069,1070] – GW

Nagios XI 2024R1.2.2

Security

  • Fixed a vulnerability to host header injection attacks [GL:XI#1216] – JS
  • Removed unnecessary percent markers from NCPA and Linux Server Wizards [GL:XI#1260] – JS

Updated

  • Updated jQuery from 1.12 to 1.13.2 [GL:XI#1218] – CN
  • Updated Nagios Plugins to version 2.4.12 – DA
  • Updated default error behavior when network requests fail [GL:XI#1159] – DA
  • Updated styling of licensing messages on first login [GL:XI#1191] – DA
  • Updated the vSphere Wizard’s “Datastore usage” metric to more accurately reflect the metric [GL:XI#1201] – BB

Removed

  • Removed download options that were erroneously added to highcharts graphs [GL:XI#1064] – DA

Added

  • Added a script to fix db corruption [GL:XI#1217] – LG
  • Added help text to upgrade.sh [GL:XI#1257] – ATC

Fixed

  • Fixed an issue where the vSphere plugin’s -list-datacenters option wasn’t functioning properly – BB
  • Fixed an issue where the vSphere plugin’s -list-clusters option wasn’t functioning properly [GL:XI#1170] – BB
  • Fixed an issue where the vSphere plugin would be unable to connect on certain OSs due to pyVmomi version – BB
  • Fixed an issue where service groups could not be edited in the CCM in some cases [GL:XI#1254] – CN
  • Fixed an issue where install/upgrade could be prevented from succeeding on EL9 if xinetd was present [GL:XI#1040] – JS
  • Fixed an issue where auto-login would not work with certain languages set [GL:XI#1164] – JS
  • Fixed an issue where timeouts when sending emails weren’t being handled properly [GL:XI#1103] – CN
  • Fixed an issue where loading the mail settings page would cause PHP errors when OAuth credentials are empty – BB
  • Fixed an issue where upgrade scripts could run on a non-corresponding installation type [GL:#1122] – CN
  • Fixed an issue where logrotate config was sometimes not being properly modified – [GL:XI#333] – JS
  • Fixed an issue where Neptune theme ad/ldap edit erroneously displayed password field [GL:XI#1251] – LG
  • Fixed an issue where users could see an unhelpful error when BBMap Dashlet does not get any data [GL:XI#1052] – JS
  • Fixed an issue where PDFs from scheduled emails would sometimes be corrupted based on Program/External URL [GL:XI#1161] – JS
  • Fixed an issue with SELinux and reporting backend [GL:XI!1022] – DA
  • Fixed an issue with the Linux Server Wizard would not display plugins on Step 2 [GL:XI#1121] – JS
  • Fixed broken pipe errors with backup generation [GL:XI#1117] – DA
  • Fixed timezone changing issues on Ubuntu 24 [GL:XI#1250] – DA
  • Fixed missing MIBs on Ubuntu 24 [GL:XI!1073] – DA
  • Fixed PHP error in Capacity Planning reports [GL:XI!1025] – SAW
  • Fixed CCM routing in the Neptune theme [GL:XI#1199] – DA
  • Fixed PHP error when deploying an agent [GL:XI!1051] – DA
  • Fixed formatting issues where scheduled emails and other pages would be sent with bad links back to XI [GL:XI#1161] – JS
  • Fixed various log file permissions [GL:XI!1066] – DA

Nagios XI 2024R1.2.1

Updated

  • Updated UX for downloading reports as PDFs – DA

Removed

  • Removed php-imap from EL9 dependencies [GL:XI#1261] – BB

Fixed

  • Fixed NRDP upgrades failing when trying to run the XI update again [GL:XI#1269] – DA
  • Fixed dependency conflict between chromium and mysql on Ubuntu [GL:XI#1271] – DA
  • Fixed an issue where a modified php.ini file could break installation or upgrade [GL:XI#511] – JS
  • Fixed MySQL password saving on repeated usage of the full install script [GL:XI#1253] – DA

Nagios XI 2024R1.2

Security

  • Added support for ModSecurity Web Application Firewall [#1084] – DA
  • Fixed privilege escalation via nagvis.conf (Thanks Exodus Intelligence for reporting this) [GL:XI#1207] – SAW
  • Improved validation in Docker Wizard and mitigated NULL poisoning vulnerability on systems with older PHP distributions (Thanks Exodus Intelligence for reporting this) [GL:XI#1206] – SAW

Updated

  • Update framework for several pages [GL:XI#1049,#1050,!828] – SG, GW
  • Improved Graph Explorer’s Neptune theme by putting graph management controls in a sliding drawer [GL:XI#1008] – LG
  • Improved Graph Explorer’s Multistacked performance graph by adding grouping by hostgroup/servicegroup [GL:XI#1008] – LG
  • Improved recognition of WEBP images when uploading via the Custom Includes component [GL:XI#1095] – DA
  • Improved Network Switch/Router Wizard to allow monitoring by Interface Name or Description [GL:XI#344] – SAW
  • Updated MySQL configuration to include default settings for max_allowed_packet, max_connections, and open_files_limit [GL:XI#1080] – GW
  • Updated NagVis to resolve PHP deprecations [GL:XI!919] – GW
  • Updated SLA Report and SLA Dashlet for Neptune [GL:XI!904] – GW
  • Updated nagios-plugins to version 2.4.10 – DA
  • Improved validation in several NRDP server plugins (Thanks Exodus Intelligence for reporting this) [GL:XI#1208] – SAW

Deprecated

  • Deprecated Debian 10, CentOS Stream 8, and EL7 [GL:XI!980] – GW

Added

  • Added Neptune Light theme [GL:XI#1028] – SG
  • Added configuration Wizard to monitor Windows via WinRM [GL:XI#1172] – AC
  • Added support for Ubuntu 24 [GL:XI#577] – GW, JM
  • Added History tab to Home->Details->Host Details and Host->Details->Service Details [GL:XI#897] – LG
  • Added Home->Incident Management->Mass Downtime page to schedule and remove downtime en masse [GL:XI#1044] – GW
  • Added ability for Nagios-Core-only contacts to use Nagios XI’s mailing configuration [GL:XI#339] – BB
  • Added new `filter` parameter to the `v1/config/host` REST API endpoint [GL:XI#1017] – LG
  • Added the ability to view data from Home->Graphs->Performance Graphs as a table [GL:XI#1005] – SG, CN
  • Added the ability to download from Home->Graphs->Performance Graphs as a CSV [GL:XI#1007] – SG
  • Added the ability to download Timestacked and Multistacked graph data from Home->Graphs->Graph Explorer as a CSV [GL:XI#1011,1010] – SG
  • Added filtering by Hostgroup or Servicegroup to Home->Graphs->Performance Graphs [GL:#1006] – CN
  • Added filtering by Hostgroup or Servicegroup to several dashlets [GL:XI#1053,!949] – GW
  • Added the ability to enable/disable PHPMailer debugging via the interface [GL:XI#175] – GW
  • Added inbound mail processing for systems that lack the PHP-IMAP library [GL:XI#61/1059] – BB

Fixed

  • Fixed an issue in the NCPA Wizard where typing a hostname into the “address” field would cause configuration to fail [GL:XI#1124] – SAW
  • Fixed issue with snmptrapsender component mistakenly indicating it wasn’t installed [GL:XI#1094] – DA
  • Fixed an issue where the “import config files” checkbox did not function when using the Neptune theme [GL:XI#1112] – SG
  • Fixed the PDF generation for the Bandwidth Usage Report [GL:XI#1079] – LG
  • Fixed an html issue on the report pages [GL:XI!897] – LG
  • Fixed a Neptune Dashlet offset when dashlets were stacked on Host & Service Status pages [GL:XI!897] – LG
  • Fixed a Neptune issue for Service Status of a down Host would have a background color on the Host Status Summary [GL:XI!897] – LG
  • Fixed an issue in the Switch/Router wizard where SNMP v3 credentials could be used to scan networked devices even when SNMP v1/v2 were selected [GL:XI#1215] – SAW
  • Fixed issue where LDAP would not show users properly [GL:XI!952] – AC

Component Updates

Core Config Manager (CCM) 3.5.0

  • Added support for MRTG configuration file management [GL:XI#48] - SAW

Nagios XI 2024R1.1.5

Security

  • Restrict RPM and offline deployments and servers with a proxy configured from performing source upgrades via web interface [GL:XI#1126,#1160] – SG
  • Fixed XSS vulnerabilities on Hostgroup and Servicegroup status pages (Thanks to Samuel Lima for reporting this) [GL:XI#1155] – CN,DA

Fixed

  • Fixed an issue where graphs could not be removed from multistacked performance graphs [GL:XI#1135] – GW
  • Fixed missing “Query” input in MSSQL Query Wizard [GL:XI#629] – SAW
  • Fixed Help->Check for Updates spinning forever when using the Custom Logo Component [GL:XI#1132] – SAW
  • Fixed an issue where the Neptune theme’s search bar would fail to complete the search [GL:XI#1119] – DA
  • Fixed the Manage MIBs page failing to load in most non-English languages [GL:XI#1156] – SAW
  • Fixed check_snmp_storage_wizard.pl so that it always shows performance data in a consistent order [GL:XI#1072] – SAW
  • Fixed log messages and other output when running background jobs and scripts [GL:XI#1117,!953] – DA
  • Fixed issue where an incorrect language value would cause the front end to not render [GL:XI#!944] – DA

Component Updates

Core Config Manager (CCM) 3.4.0

  • Add support for ‘*’ to dependent services - SAW
  • Add support for ‘!’ (exclusion) to dependent services - SAW

Nagios XI 2024R1.1.4

Updated

  • Prevent postfix being unable to start from stopping the install process [GL:XI#1137] – DA

Added

  • Added verification before upgrades to ensure that Nagios Core configuration is applied and valid – SAW

Fixed

  • Fixed issue in NagVis where a user could use schemes other than http as a hover url (Thanks to Márk Rákóczi for reporting this) [#1062] – DA
  • Fixed issue in Admin->Check for Updates where the interface would not indicate a successfully completed update – SAW
  • Fixed issue where new API could halfway complete upgrading, rendering the application unusable [GL:XI#1131] – SAW

Component Updates

Core Config Manager (CCM) 3.3.1

  • Fix regression where setting max_check_attempts (among others) to 3 caused the entry to disappear from the applied configuration text file [GL:XI#1133,#108] - SAW

Nagios XI 2024R1.1.3

Security

  • Fixed XSS in Capacity Planning component (Thanks to Márk Rákóczi for reporting this) [GL:XI!834] – DA
  • Fixed both XSS in Executive Summary report and ajaxhelper endpoint that was too open (Thanks to Márk Rákóczi for reporting this) [GL:XI#1046] – DA

Updated

  • Improved report options and fixed various associated issues [GL:XI#897,#899,#905] – GW
  • Improved the UX of applying configurations in the CCM to make it faster and easier [GL:XI#1027] – BB
  • Several minor interface improvements [GL:XI#593,#867,#868,#869,#870,#871,#872,#874,#875,#877,#880,#884,#887,#889,#890,#898,#900,#902,#903,#906,#913,#919,#920,#921,#922,#923,#926,#927,#930,#932,#934,#935,#936,#938,#939,#940,#942,#943,#945,#947,#948,#949,#959,#961,#962,#964,#967,#968,#969,#971,#974,#975,#979,#981,#1004,#1043,#1067,!868] – GW,SAW,DA
  • Updated icons on the My Tools and Common Tools page [GL:XI#918] – KV
  • Updated icons in the Announcement Banners page [GL:XI#925] – KV
  • Updated icons in the AD/LDAP page [GL:XI#924] – KV
  • Updated required versions and corrected various versioning issues across several components – GW
  • Updated and fully released the vSphere Wizard – BB
  • Updated default log rotation to include new report exporting backend’s log files [GL:XI!863] – DA
  • Do not allow jinja2 templates in migrate_core.yml (Thanks to Márk Rákóczi for reporting this) [GL:XI#1063] – DA
  • Fixed inability to set custom URL and title for the Neptune theme in the Home Page Modifications component [GL:XI#632] – DA
  • Fixed inability to use the manage dashboards page in all themes [GL:XI!795] – DA

Removed

  • Removed the scroll bar from a number of dashlets that shouldn’t have it [GL:XI#1002] – GW

Added

  • Added default log rotation settings for snmptrapsender.log [GL:XI#860] – SAW
  • Added default MRTG configuration when installing or upgrading Nagios XI via RPM package [GL:XI#782] – SG

Fixed

  • Fixed an issue where some dashlets would not save dimensions altered by the user [GL:XI#1001] – GW
  • Fixed a crash in the database maintenance background job [GL:XI#1031] – SAW
  • Fixed an issue in the NRPE Wizard where the NRPE command would always use the default settings [GL:XI#1042] – SG
  • Fixed an issue where swap metric would not load unless the user manually set the graph’s viewport [GL:XI#983] – GW
  • Fixed an issue in Host/Service Details where “View Performance Graphs” would fail to load when the service’s name was “/” [GL:XI#790] – SAW
  • Fixed an issue where files with capitalized file extensions could not be uploaded to Admin->Custom Includes [GL:XI#816] – SAW
  • Fixed an issue in the NLS Wizard where it would fail to connect if NLS was configured to use HTTPS [GL:XI#793] – SG
  • Fixed incorrect SNMP version in checks configured by the Watchguard configuration Wizard [GL:XI#1034] – SAW
  • Fixed an issue where monitoring objects could not inherit from templates when configured via the API [GL:XI#108] – SG
  • Fixed issues with ‘$’ and ‘!’ in ncpa tokens and escaped values in Docker Wizard [GL:XI#855] – SG
  • Fixed issues with ‘$’ and ‘!’ in ncpa tokens in Cloud VM, Hyper-V, Java Application Server, and Windows Event Log Wizards [GL:XI!739] – SG
  • Fixed a non-working fallback when users add AD/LDAP certificates on systems with older versions of OpenSSL [GL:XI#1074] – SAW
  • Fixed an issue in the Network Switch / Router Wizard where user-inputted whitespace in the IP Address field would cause the Wizard to fail [GL:XI#792] – SAW
  • Fixed an issue in the Network Switch / Router Wizard where the table in the second page was not readable on the Modern Dark theme [GL:XI#720] – SAW
  • Fixed an issue where users without permission could add hosts and services in the Core Config Manager [GL:XI#846] – CN
  • Fixed bulk entry in the Network Switch / Router Wizard [GL:XI#777] – SAW
  • Fixed an issue where users in nested Organizational Units were not found when importing users from AD/LDAP – [GL:XI#72] – CN
  • Fixed an issue where HTML tags would be displayed in error feedback when applying configurations [GL:XI#1023] – CN
  • Fixed an issue where bulk modification would not work with multiple options [GL:XI#631] – GW
  • Fixed an issue where the Bulk Modifications tool could not find relationships when one or more objects had a ‘#’ in its name [GL:XI#797] – CN
  • Fixed two cases where the Bulk Modification tool would crash on clicking “Find Relationships” and while trying to remove Custom Variables [GL:XI#603] – JS
  • Fixed an issue where NDO failed to start when using an offloaded database [GL:XI#95] – CN
  • Fixed an issue where a user’s password change would cause a user ID (and not username) to be logged in the Audit Log [GL:XI#1056] – SAW,AC
  • Fixed an issue where non-authorized users could access Wizards via Popular Wizards [GL:XI#734] – GW
  • Fixed an issue where RPM upgrades from before 2024R1 would incorrectly encrypt inbound NRDP tokens [GL:XI#844] – DA
  • Fixed an issue where uploading a plugin with the same name as an existing plugin would replace the plugin with no warning [GL:XI#676] – SG
  • Fixed broken link in Esensors Websensor Wizard – SAW
  • Fixed deprecated code in RSS Dashlet [GL:XI#578] – SAW
  • Fixed issue with views URLs in the Neptune theme [GL:XI!807] – DA
  • Fixed permissions in users endpoint in the new V2 API (Thanks to Márk Rákóczi for reporting this) [GL:XI#1036] – DA
  • Fixed an issue where phpmailer.log did not have the correct permissions [GL:XI#856] – LG
  • Fixed an issue in network reports, network queries, and the NNA Wizard where network requests were silently failing when Nagios XI was configured with HTTPS and NNA was configured with HTTP [GL:XI#852,#1015,#1014] – SG
  • Fixed an issue in the Alert History Dashlet where all cells would show as red in when no state changes had occurred [GL:XI#859] – SAW
  • Fixed Backup and Restore across Linux distributions that use different database collations. [GL:XI#361]- LG
  • Fixed an issue where the “User Sessions” page would show spurious session entries [GL:XI#695] – DA
  • Fixed an issue where a password change wouldn’t invalidate other sessions (Thanks to Jack Eli for reporting this) [GL:XI#850] – DA
  • Fixed an issue in the NCPA Wizard where users could not utilize the same plugins, services and products more than once for service checks. [GL:XI#785] – KV
  • Fixed an issue in the NCPA Wizard where the Wizard would crash when the network connection to NCPA was inconsistent [GL:XI#551] – LG
  • Fixed unencrypted v3 SNMP passwords from SNMP Trap Sender component [GL:XI#557] – DA
  • Fixed PHP 8 deprecation warnings – DA
  • Fixed an issue where the words “Enterprise License” were erroneously displayed [GL:XI#1054] – LG
  • Fixed an issue where the Neptune theme was missing from the Audit Log’s “Send to Nagios Log Server” page [GL:XI#1051] – LG
  • Fixed a Ubuntu 22 Install issue [GL:XI#1073] – JM
  • Fixed issues with scaled dashlets going outside of their boundaries [GL:XI!853] – DA
  • Fixed missing language packages on RPM installs on Enterprise Linux 8 [GL:XI!889] – DA
  • Fixed restoring XI from a backup when all passwords are the same [GL:XI#1091] – DA

Component Updates

Core Config Manager (CCM) 3.2.5

  • Fixed an issue where timeranges could not be removed from timeperiods [GL:XI#1003] - SAW
  • Fixed an issue where indrect servicegroup relationships were not being found, allowing bidirectional relationships to be created erroneously [GL:XI#996] - CN

Nagios XI 2024R1.1.2

Security

  • Fixed an issue where unused API endpoints posed a security vulnerability (Thanks to Márk Rákóczi for reporting this) [GL:XI#1036] – DA

Fixed

  • Fixed an issue where any user could modify an insecure login ticket (Thanks to Márk Rákóczi for reporting this) [GL:XI#1037] – DA
  • Fixed an issue where the login form would submit to the current url and not login.php (Thanks to Kevin De Frene for reporting this) [GL:XI#1041] – DA

Nagios XI 2024R1.1

Security

  • Fixed XSS in page-missing.php (Thanks to Adam Kues from Assetnote for reporting this) [GL:XI#849] – DA

Updated

  • Replaced wkhtmltox reporting backend with chromium [GL:XI#795] – DA

Deprecated

  • Deprecated Folder Watch Wizard [GL:XI#832] – JS

Removed

  • Removed “Download as JPG” button for all reports

Added

  • Added new Neptune UI theme – AC,GW,KV,LG,DA,CN,SAW,SG,SNS,BB,JS
  • Added new vSphere configuration Wizard [GL:XI#313] – JL,BB,SG
  • Added new Alert History Dashlet (calendar view) [GL:XI!488] – SAW
  • Added the ability to select metric to view in Metrics Dashlet [GL:XI#15] – GW

Fixed

  • Fixed broken Wizard favorites and added duplicate removal to favorites [GL:XI#502/564] – GW
  • Fixed issue where the Mail Server wizard would fail to apply configuration after completion [GL:XI#827] – CN
  • Fixed issue with Network Report where records variable was not converting from object to array [GL:XI#549] – GW
  • Fixed deprecation warnings when using “My Reports” page on newer linux distributions – SAW
  • Fixed issue where the Amazon EC2 Wizard would timeout [GL:XI#826] – CN
  • Fixed an issue where upgrades would fail when HTTP was disabled [GL:XI#783] – SAW
  • Fixed SSH Proxy Wizard issue that prevented services from being added correctly [GL:XI#833] – JS
  • Fixed several issues in the Bulk Host Import Wizard [GL:XI#820] – SG
  • Fixed several issues in the Passive Check Wizard [GL:XI#831] – SG,SAW
  • Fixed several issues in the Passive Objects Wizard [GL:XI#834] – KV
  • Fixed an issue with restoring XI2024R1 to another XI2024R1 server [GL:XI#572] – LG, DA
  • Fixed an issue with randomized folders in backup tarball [GL:XI#818] – DA
  • Fixed an issue where a fatal php error was thrown while editing my reports – SG

Component Updates

Core Config Manager (CCM) 3.2.4

  • Fixed white-on-white input and button text in CCM login page on Modern Dark theme [GL:XI#719] - SAW

Nagios XI 2024R1.0.2

Security

  • Fixed XSS in Nagios Core command expansion page (Thanks to Joran LEREEC for reporting this) [GL:XI#654] – DA
  • Fixed a SQL injection vulnerability in favorites component. (Thanks to Jarod Jaslow for reporting this) (CVE-2024-24401) [GL:XI#667] – DA
  • Fixed a privilege escalation vulnerability from nagios to root (Thanks to Jarod Jaslow for reporting this) (CVE-2024-24402) [GL:XI#668] – DA
  • Fixed a privilege escalation vulnerability in autodiscover_new.php (Thanks to Wahab Khadir for reporting this) [GL:XI#669] – DA

Deprecated

  • Deprecated Ubuntu 18 [GL:XI#579] – DA

Fixed

  • Fixed issue with column statistics table not existing with offloaded databases and backups [GL:XI#247] – DA
  • Fixed an issue where users would not be able to upgrade when they had offloaded databases [GL:XI#584] – DA
  • Fixed an issue where backups would fail due to a full tmp directory [GL:XI#602] – DA
  • Fixed an issue where recurring_downtime.php would exit because of it’s own pid [GL:XI#693] – DA

Component Updates

Core Config Manager (CCM) 3.2.3

  • Fix a regression from XI 2024R1.0.1 where the “Remove all” button was broken on some overlays - SAW

Nagios XI 2024R1.0.1

Security

  • Fix an privilege escalation vulnerability in the System Profile component (Thanks to Matthew Bach from Hack The Box Ltd for reporting this) [GL:XI#532] – KF
  • Fixed XSS vulnerability in NOC screen (Thanks Cosmin-Constantin Cojocaru for reporting this issue) (CVE-2023-51072) [GL:XI#568] – DA
  • Removed world read permissions from resource.cfg [GL:XI#256] – DA

Updated

  • Corrected formatting of admin-provided user data [GL:XI#548] – JM
  • Improved icons and help text in page footer [GL:XI#530] – GW
  • Improved troubleshooting experience for AD/LDAP debugging [GL:XI#474,GL:XI#585] – SAW,SG
  • Improved performance on systems that monitor many NCPA nodes by adjusting check_ncpa.py timeout [GL:XI#507] – SG
  • Disallow use of wildcard selector for restricted CCM users [GL:XI#174] – GW
  • Updated icons in the System Component Status dashlet [GL:XI#529] – GW
  • Fix an issue with dark mode in user macros page [GL:XI#524] – SG
  • Restored “Home” menu link when Custom Logo component is in use [GL:XI#550] – CN

Removed

  • Removed uses of deprecated strftime function [GL:XI#489] – JS

Added

  • Added timestamps to logs found in /usr/local/nagiosxi/var/ [GL:XI#65] – CD
  • Added convenience script to load MySQL passwords from configuration files [GL:XI#509] – DA

Fixed

  • Fixed an issue where users would not be able to upgrade to XI 2024R1 if they changed their root MySQL password [GL:XI#588] – SAW
  • Fixed an issue where the CCM would prevent some valid service dependencies from being configured [GL:XI#113] – GW
  • Fixed UI visibility issues when using the Migrate Server feature in dark mode [GL:XI#435] – KV
  • Fixed minor UI issues when completing a configuration Wizard [GL:XI#538] – GW
  • Fixed an issue in BPI where dropdown chevron was pointing in the wrong direction on page refresh [GL:XI#513] – GW
  • Fixed PDF report generation on reports with large amounts of data [GL:XI#350] – DA
  • Fixed missing debug logging in the AD/LDAP configuration on Enterprise Linux 8 and 9 [GL:XI#442] – DA
  • Fixed inconsistent file permissions related to the Network Switch/Router Wizard on Ubuntu [GL:XI#471] – SG
  • Fixed issue where the SLA Report, Capacity Planning Report, and Audit Log were incorrectly blocked for some users with valid enterprise trials [GL:XI#522] – GW
  • Fixed Graph Explorer icons not working for hosts that have a space in their hostnames [GL:XI#470] – GW
  • Fixed PHP warnings when adding a service in the CCM [GL:XI#484] – GW
  • Fixed an issue where timezone changes were not correctly applied on Enterprise Linux 9 [GL:XI#458] – GW
  • Fixed two cases where the Bulk Modifications tool would crash when modifying more than 200 hosts or services [GL:XI#373] – JS
  • Fixed an issue where the recurring downtime background job would have mutliple processes running at once [GL:XI#309] – SG
  • Fixed an issue where the recurring downtime background job would log errors when modifying empty host groups [GL:XI#309] – SG
  • Fixed an issue where Highcharts graphs would use online exporting when local exporting was selected [GL:XI#29] – AC
  • Fixed an issue where MRTG files would not have the correct permissions set on upgrades [GL:XI#38] – BB
  • Fixed a divide-by-zero issue and some warnings in metrics component [GL:XI#512] – GW
  • Fixed an issue where new user tours would sometimes fail to reset [GL:XI!426] – BB
  • Fixed an issue where the notifications history page would not save parameters when saved as a view [GL:XI#146] – BB

Nagios XI 2024R1

Security

  • Improved security of default database password generation (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#424] – DA
  • Improved security of randomly-generated text, including API keys (Thanks to Abdulmohsen Alotaibi for reporting this) [GL:XI#433] – DA
  • Improved security of Ansible Vault credentials in Nagios Core-to-XI migration tool (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#426] – DA
  • Fixed vulnerability with time-based port scanning on ftp connections in Scheduled Backups component (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#422] – DA
  • Fixed a security issue in migrate.php that allowed root code execution from user input (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#415] – DA
  • Fixed an XSS vulnerability in the graphexplorer component (Thanks to Pankaj Kumar Thrakur for reporting this) [GL:XI#468] – DA
  • Fixed a security issue with backup_xi.sh allowing deletion of arbitrary directories (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#428] – DA
  • Fixed some missing access controls in the Nagios XI 5 API (Thanks Matthew Bach and Hack The Box Ltd for reporting this) (CVE-2023-51124) [GL:XI#520] – SAW

Updated

  • Improved multiple-selection widgets in several configuration wizards [GL:XI#444, GL:XI#475] – PhW
  • Improved authorization requirements when editing USER and System Macros in the CCM (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#425] – DA
  • Improved input validation in send_to_nls.php script (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#427] – DA
  • Updated login page [GL:XI#394] – CN
  • Moved the help menu to a dropdown in the upper-right corner of the screen [GL:XI#455] – SG
  • Disabled web SSH Terminal by default (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#416] – DA

Removed

  • Removed DROP and DELETE permissions from the Nagios XI user for the auditlog table (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#420] – DA
  • Removed support for PostgreSQL – SAW

Added

  • Added tours for the homepage and wizards [GL:XI#402] – BB
  • Added the ability to view the most used and most recently used configuration wizards [GL:XI#462] – GW
  • Added Colorblind theme for users with red-green colorblindness [GL:XI#453] – JS
  • Added a page to enable/disable notifications for hosts and services en masse [GL:XI#378] – SG
  • Added new home dashboard [GL:XI#397] – CN
  • Added client side form validation and updated appearance for most Wizards [GL:XI#300,XI#395] – LG
  • Added a new built-in “demo” dashboard and associated new dashlet [GL:XI#473] – GW
  • Added configuration wizard to monitor OpenAI Usage. [GL:#403] – PhW
  • Added configuration wizard to set up Slack notifications [GL:XI#399] – BB
  • Added configuration wizard to set up Discord notifications [GL:XI#400] – BB
  • Added new SNMP Trap Volume Dashlet – SAW
  • Added new Modern Gauge Dashlet – BB
  • Added an Enterprise top-level menu and page – [GL:XI#452] – KV
  • Added sticky header and sort by status to BBMap [GL:XI#448,#449] – LG

Fixed

  • Fixed incorrect table header in Configure->Core Config Manager->Hosts [GL:XI#477] – KV
  • Fixed PHP Warnings when adding a host in the CCM [GL:XI#483] – SAW
  • Fixed PHP warnings from use of deprecated split() function [GL:XI#467] – GW
  • Fixed PHP warnings when processing SNMP Traps in the Manage MIBs page [GL:XI#480] – SAW
  • Fixed an issue that allowed users with expired trial and enterprise licenses to access enterprise features [GL:XI#437] – GW
  • Fixed PHP warnings when adding a hostgroup in the CCM [GL:XI#483] – SAW
  • Fixed PHP warnings when adding a servicegroup in the CCM [GL:XI#481] – SAW
  • Fixed use of deprecated utf8_encode() in Locale selection and CCM Audit Log [GL:XI#491] – SAW
  • Fixed use of deprecated functions in CCM log management [GL:XI:#490] – SAW
  • Fixed plaintext storage of sensitive information in the database (Thanks to Oliver Brooks and Colin Brum from NCC group for reporting this) [GL:XI#421] – DA

Nagios XI 5.11.3

Security

  • Fixed an XSS in the custom logo component (Thanks Astrid Tedenbrant and Outpost24 for reporting this) [GL:XI#412] – BB
  • Fixed a Remote Code Execution vulnerability in the Core Config Manager (Thanks Abdulmohsen Nasser Alotaibi for reporting this) [GL:XI#383] – SNS
  • Fixed an XSS vulnerability in the Graph Explorer component (Thanks Aleksey Solovev from Positive Technologies for reporting this) [GL:XI#384] – SG
  • Fixed an XSS vulnerability in bandwidthreport component (Thanks Aleksey Solovev from Positive Technologies for reporting this) [GL:XI#385,#463] – SG
  • Fixed an XSS vulnerability in Bulk Modifications component (Thanks Aleksey Solovev from Positive Technologies and Abdulmohsen Nasser Alotaibi for reporting this) [GL:XI#386] – SG
  • Fixed a CSRF and XSS vulnerability in the custom-includes component (Thanks Aleksey Solovev from Positive Technologies for reporting this) [GL:XI#387] – BB
  • Fixed a CSRF and XSS vulnerability in the hypermap replay component (Thanks Aleksey Solovev from Positive Technologies for reporting this) [GL:XI#388] – BB
  • Fixed an XSS vulnerability in the CCM (Thanks Aleksey Solovev from Positive Technologies for reporting this) [GL:XI#389] – BB
  • Fixed several SQL injection vulnerabilities in the Bulk Modifications Tool (Thanks Aleksey Solovev from Positive Technologies for reporting this) [GL:XI#390] – SG
  • Fixed a shell injection vulnerability in the Manage MIBs page (Thanks Aleksey Solovev from Positive Technologies for reporting this) [GL:XI#392] – SG
  • Fixed an XSS vulnerability in Manage Users (Thanks Oliver Brooks and Colin Brum from NCC Group for reporting this) [GL:XI#429] – BB
  • Fixed a PHP code injection vulnerability in the graph template editor (Thanks Oliver Brooks and Colin Brum from NCC Group for reporting this) [GL:XI#430] – BB
  • Fixed a Remote Code Execution vulnerability in the Core Config Manager (Thanks Abdulmohsen Nasser Alotaibi for reporting this) [GL:XI#383] – SNS

Updated

  • Improved UX of the Operation Center configure sound modal [GL:XI#370] – SG

Added

  • Added the ability to modify homepage settings when a dashboard is set as the homepage – BB

Fixed

  • Fixed an issue where phantomjs was not working properly on an offline upgrade – CB
  • Fixed an issue with unhelpful error messages in email settings [GL:XI#363] – AC
  • Fixed an issue in Executive Summary where the report would be named incorrectly for [Host Only] and [All Services] reports [GL:XI#340] – SAW
  • Fixed an issue in State History where the report would show service states when [Host Only] was selected [GL:XI#340] – SAW
  • Fixed typo in Performance Settings – SAW
  • Fixed an issue where Homepage Customization would indicate that it was disabled when it was enabled [GL:XI#376] – BB
  • Fixed an issue where Homepage Customization cog would not show in the dashboard view [GL:XI#376] – BB
  • Fixed an issue that caused “Send Test Email” button to break if “From Address” was invalid [GL:XI#367] – BB
  • Fixed an issue that caused performance graphs to display an incorrect “Max” value [GL:XI#336] – BB
  • Fixed an issue where host and service statuses would be partially truncated on Ubuntu [GL:XI#259] – BB
  • Fixed an issue where the Announcement Banners table looked broken when there were no banners configured [GL:XI#358] – SG
  • Fixed an issue that caused errors to show when using a dashboard as the home page – BB
  • Fixed an issue where Deploy Agent would fail when deploying to an Ubuntu minimal install [GL:XI#177] – BB
  • Fixed an issue that was causing browser console errors on the Email page – BB
  • Fixed an issue where the Host status detail page was showing OK when a service was Pending [GL:XI#352] – BB
  • Fixed an issue where adding/editing a command in the CCM would have a broken page – BB
  • Fixed an issue where CCM forms could show errors when editing commands or services – BB
  • Fixed an issue where Bulk Modifications -> Add Parent Host would break on PHP 8 [GL:XI#375] – BB
  • Fixed missing dependency (php-pecl-ssh2) in Scheduled Backups [GL:XI#290] – BB
  • Fixed missing authorization controls in Unconfigured Objects (Thanks Oliver Brooks and Colin Brum from NCC Group for reporting this) [GL:XI#419] – BB

Nagios XI 5.11.2

Security

  • Added security setting to block remote sites from loading via xiwindow parameter [GL:XI#302] – DA
  • Fixed XSS in Custom Logo component (Thanks Astrid Tedenbrant and Outpost24 for reporting this) (CVE-2023-40932) – AC
  • Fixed SQL injection vulnerability acknowledging an announcement banner (Thanks Astrid Tedenbrant and Outpost24 for reporting this) (CVE-2023-40931) – SG
  • Fixed SQL injection vulnerability in the accouncement banner configuration interface (Thanks Astrid Tedenbrant and Outpost24 for reporting this) (CVE-2023-40933) – BB

Updated

  • Fixed an issue where the side menu wouldn’t automatically update when scheduled reports were added or deleted [GL:XI#331] – DA
  • Fixed an issue that would sometimes cause dashlets to reappear on the Home page when deleted [GL:XI#85] – SNS
  • Improved clarity of error messages in CCM when attempting to modify a host with broken sql tables [GL:XI#173] – SG
  • Updated verbiage in the Mountpoint Wizard for clarity [GL:XI#110,#279] – DA
  • Updated styling on the home page [GL:XI#169] – DA
  • Updated verbiage surrounding custom variables to be more consistent [GL:XI#151] – SG
  • Updated modal presented when acknowledging problems for clarity [GL:XI#299] – SG
  • Removed Alert Cloud Dashlet because Flash is no longer supported [GL:XI#164] – SNS

Deprecated

  • Deprecated WMI and Web Transaction [GL:XI#317] – SNS

Removed

  • Removed Nagios News Feed Dashlet [GL:XI#298] – SNS
  • Removed autcomplete from Wizard Address Field [GL:XI#87] – SNS

Added

  • Added fuzzy search to the Configuration Wizard page – SNS
  • Added the ability to resize some dashlets [GL:XI#285] – SNS
  • Added “Maximum Downtime History Age” to performance settings [GL:XI#287] – SAW

Fixed

  • Fixed an issue that caused sound settings to not display correctly in the operation center [GL:XI#24] – SG
  • Fixed an issue with logrotate permissions for the CentOS 9 OVA [GL:XI#197] – DA
  • Fixed an issue with password reset emails not containing correct URLs [GL:XI#23] – DA
  • Fixed an issue where macro variables weren’t expanding properly in notes URLs [GL:XI#315] – SG
  • Fixed an issue where new users weren’t being shown existing banner messages [GL:XI#277] – SG
  • Fixed an issue with the announcement banner switch showing incorrect status on page load [GL:XI#266] – SG
  • Fixed an issue where the License Information screen would fail to load [GL:XI#249] – SAW
  • Fixed an issue with permissions in the Network Switch Wizard [GL:XI#347] – SG
  • Fixed an issue where several tables would not get truncated in a script for removing historical data [GL:XI#284] -TG
  • Fixed an issue in network switch wizard where the Bulk Configuration Settings were not handling mismatched field inputs [GL:XI#312] – SG
  • Fixed an issue in the update process where the settings would be unexpectedly reset upon upgrading in the oracle tablespace wizard [GL:XI#311] – SG
  • Fixed an issue where selected months would start with a comma under certain circumstances in recurring downtime [GL:XI#330] – SG
  • Fixed an issue in the views tab where the fullscreen button moved while in fullscreen during rotating views [GL:XI#163] – SG
  • Fixed an issue in dark mode where cloning a user and canceling the menu would display non-dark mode css [GL:XI#271] – SG
  • Fixed an issue in AD/LDAP where having more than 1000 users would cause layout issues [GL:XI#13] – SG
  • Fixed an issue causing reports to fail to run successfully [GL:XI#316,#296] – DA
  • Fixed an issue where users without enterprise feature can set snmp traps in the manage mibs interface [GL:XI#176] – SG
  • Fixed an issue where pages would throw console errors [GL:XI#258] – BB
  • Fixed an issue where a sufficiently large amount of logs would crash the audit log page [GL:XI#325] – DA
  • Fixed an issue where unused service and host check tables were enabled by default sometimes causing database corruptions [GL:XI#242] – SG
  • Fixed an issue where the Sans Rising Ports dashlet would create many DB access errors [GL:XI#338] – DA
  • Fixed an issue where SNMPv2-PDU had a bad trap definition [GL:XI#78] – DA
  • Fixed an issue where the redirect parameter on the login page wouldn’t work if the user was already authenticated [GL:XI#150] – DA
  • Fixed an issue where the application log would show database errors on systems that were integrated with deprecated products [GL:XI#303] -TG
  • Fixed an issue with the contact PUT endpoint in the API did not allow custom variables [GL:XI#115] – DA
  • Fixed an issue where XI would fail to export performance data graphs when offline [GL:XI#29] – SNS
  • Fixed an issue where the SLA page would render incorrectly due to some variable definitions [GL:XI#345] – SNS
  • Fixed an issue where Wizard Search did not catch quick inputs [GL:XI#265] – SNS
  • Fixed an issue where the Oracle Serverspace Wizard was overwritting settings on upgrades [GL:XI#343] – SG
  • Fixed an issue where the Oracle Query Wizard was overwritting settings on upgrades [GL:XI#342] – SG
  • Fixed an issue where Email Settings would fail to save but indicated that the credentials were saved [GL:XI#263] – BB
  • Fixed an issue where the services list on the Host Detail page was showing the display name instead of the service description [GL:XI#293] – BB
  • Fixed an issue where python was not defined in report scripts [GL:XI#307] – SNS
  • Fixed an issue where editing SNMP Trap Sender settings would break on PHP 8+ [GL:XI#149] – SG
  • Fixed an issue that could lead to a blank screen when editing service templates while utilizing PHP 8+ [GL:XI#334] – SG
  • Fixed an issue where Wizard fields with trailing whitespaces would break data visualizations [GL:XI#308] – SNS
  • Fixed an issue where whitespaces in the License Information page would cause problems [GL:XI#341] – SNS
  • Fixed an issue where adding a dashlet would break the page if a confirmation window was open [GL:XI#323] – BB
  • Fixed an issue where deleting multiple dashlets would cause console errors [GL:XI#324] – BB
  • Fixed an issue where sendmail couldn’t send to @localhost on PHP 8 [GL:XI#229] – BB
  • Fixed an issue where external redirects weren’t being blocked when using PHP 8 [GL:XI#199] – BB
  • Fixed an issue where the logrotate configuration wasn’t being updated properly [GL:XI#333] – BB
  • Fixed an issue where service descriptions weren’t displaying properly [GL:XI#293] – BB
  • Fixed an issue where the NCPA wizard would crash on PHP 8 [GL:XI#240] – BB
  • Fixed an issue where OAuth credentials could indicate that they succeeded when they failed if the user manually modified the files incorrectly [GL:XI#263] – BB
  • Fixed an issue where Highcharts graphs would show 0 for the Max: field in the labels [GL:XI#336] – BB
  • Fixed an issue with Email settings where it would check for SSL/TLS if None was selected [GL:XI#227] – BB
  • Fixed an issue where removing multiple dashlets would cause errors [GL:XI#324] – BB
  • Fixed an issue where Bootstrap popups wouldn’t close when switching tabs in the application [GL:XI#122] – BB

Component Updates

Core Config Manager (CCM) 3.2.1

  • Fixed issue allowing users to select inactive timeperiods [GL:XI#162] -AC
  • Fixed SQL injection vulnerability in the CCM Host and Service Escalation pages (Thanks Astrid Tedenbrant and Outpost24 for reporting this) (CVE-2023-40934) - DA

Nagios XI 5.11.1

Fixed

  • Fixed an issue where NDO would be misconfigured on upgrade – SAW
  • Fixed an issue where the NCPA configuration wizard would fail to load on some operating systems [GL:XI#123] – AC
  • Fixed an issue where the Autodiscovery configuration wizard would fail to load on some operating systems [GL:XI#123] – SS

Nagios XI 5.11.0

Updated

  • Changed BPI Groups page so that groups are sorted in descending status order. [GL:XI#160,#276] – PG, DA
  • Improved styling of “Email All Users” modal in dark mode on Manage Users page [GL:XI#250] – SG
  • Improved user experience in the SNMP Trap Interface [GL:XI#185] – PG
  • Improved performance in Capacity Planning report [GL:XI#52] – SNS
  • Updated nagios-plugins to version 2.4.5 – SAW

Added

  • Added the Windows SSH wizard to replace the Windows WMI wizard [GL:XI#117] – SNS
  • Added the ability to globally set number of hops in the Traceroute Action component [GL:XI#167] – PG
  • Added the ability to set system-wide banner messages [GL:XI#82] – SG
  • Added the ability to sort by additional parameters on the Manage Users page [GL:XI#80] – PG

Fixed

  • Fixed an issue in the help section where a duplicate document was being created [GL:XI#231] – AC
  • Fixed an issue in Report Management where negative page values caused an error to display [GL:XI#233] – SG
  • Fixed an issue with PostgreSQL to MySQL migration when the XI server was migrated across Linux distributions [GL:XI#230] – SAW
  • Fixed an issue causing an error on any page with a checkbox [GL:XI#238] – AC
  • Fixed an issue where TLS was always enabled when using SMTP on systems running PHP 7.4 or greater [GL:XI#237] – AC
  • Fixed an issue where removing certain optional dependencies would cause all dependencies to uninstall [GL:XI#241] – SAW
  • Fixed an issue where certain valid trial keys would fail to activate – SAW
  • Fixed a UI issue in Chromium-based browsers when mutliple banners are shown [GL:XI#275] – SG, DA
  • Fixed minor interface issue in Host and Service Status Detail pages [GL:XI#273] – SG
  • Fixed spelling error in scheduled backups [GL:XI#267] – SG

Nagios XI 5.10.0

Security

  • Added force mass immediate check functionality to the API [GL:XI#129] – DA

Updated

  • Improved readability for the SDESC/EDESC section of a defined trap in the SNMP Trap Interface [GL:XI#41] – PG
  • Fixed an issue where nagios.log was not included in the system profile [GL:XI#114] – CL
  • Disabled TRACE, TRACK, OPTIONS, HEAD methods for apache [GL:XI#57] – DA

Removed

  • Removed installation handling for unsupported operating systems [GL:XI#98] – SNS

Added

  • Added the ability to change service display names in the Bulk Renaming Tool [GL:XI#88] – CL
  • Added the ability to export and import dashboards [GL:XI#90] -AC
  • Added the ability to undo/redo recent changes when modifying dashlets – SNS
  • Added the CSV output type to the API [GL:XI#53] – CL,DA
  • Added the ability to send mail with OAuth2 using Microsoft – BB
  • Added the ability to send mail with OAuth2 using Google – BB

Fixed

  • Fixed an issue where Tools crashed when deleting added tools [GL:XI#128] – AC
  • Fixed an issue where certain dependencies would throw warning during installation [GL:XI#100] – SNS
  • Fixed an issue where links in BPI groups were incorrect [GL:XI#75] – PG
  • Fixed an issue where xml errors occured when using bulk renaming tools [GL:XI#88] – CL, BB
  • Fixed an issue where notify-host-by-email and notify-service-by-email would not send mail on CentOS Stream 9 [GL:XI#198] – SAW
  • Fixed an issue where adding a host or service to Nagvis would fail in MySQL 8 [GL: XI#106] – AC
  • Fixed an issue where the Nagvis component was not being upgraded to version 2.1.4 during an XI upgrade. [GL:XI#101] – AC
  • Fixed an issue where Autodiscovery and NCPA configuration wizards would break on systems running PHP 8 [GL:XI#123] -AC
  • Fixed an issue in the Manage MIBs page where one MIB entry showed two entries [GL:XI#77] – DA
  • Fixed an issue where certain logs would become cluttered when XI was offline [GL:XI#64] – PG
  • Fixed an issue where a white screen occurs when bulk-modifying contact groups on Ubuntu [GL:XI#170] – AC
  • Fixed an issue where LDAP/AD users had to conform to local password requirements [GL:XI#109] – AC
  • Fixed several issues with configuring SSL/TLS for AD/LDAP integration [GL:XI#4,5,112] – BB
  • Fixed an issue where dashlet borders were using Modern theme colors on Modern Dark theme when resizing [GL:XI#66] – AC
  • Fixed an issue where the Edit function of the SNMP Trap Interface was loading improperly [GL:XI#135] – PG
  • Fixed an issue in the profile script where Oracle system’s Linux distribution was incorrectly displayed [GL:XI#25] – SG
  • Fixed an issue where deactivating a service marked all services on that host as “not applied” [GL:XI#103] – DA
  • Fixed an issue where PHP-FPM would exhaust usable memory [GL:XI#152] – DA
  • Fixed an issue where the check_xi_update plugin would fail on PHP 8 [GL:XI#134] – SNS
  • Fixed an issue where feedback messages were not being displayed properly after applying bulk changes in the SNMP Trap Interface [GL:XI#183] – SG
  • Fixed an issue where phpmailer.log was not rotated, causing it to grow indefinitely [GL:XI#121] – SNS
  • Fixed several issues during installation while FIPS mode is enabled [GL:XI#139] – DA
  • Fixed SNMP Trap UI-UX on both edit and copy modals [GL: XI#188] – PG

Component Updates

Core Config Manager (CCM) 3.2.0

  • Added the ability to add and delete additional Arguments in CCM [GL:XI93] - PG
  • Fixed an issue where users were able to configure invalid service escalations [GL:XI#102] - AC
  • Fixed issue where a white screen would be displayed when editing contacts on Ubuntu [GL:XI#155] - AC

Nagios XI 5.9.3

Security

  • Fixed possible timing attack when using insecure ticket authentication (Thanks to Kevin Joensen of CSIS for reporting this issue) (CVE-2023-24035) -SAW
  • Fixed open redirect in Twilio component (Thanks Kevin Joensen and CSIS) (CVE-2023-24036) -SAW
  • Improve authentication token and salt generation (Thanks Kevin Joensen and CSIS) (CVE-2023-24037) -SAW
  • Update default php resource values [GL:XI#28] – SNS

Updated

  • Deprecate Debian 9 and Ubuntu 16.04 due to end-of-life [GL:XI#27] – SNS

Fixed

  • Fixed bad text wrapping in Availability Report graphs [GL:XI#73] -DA

Nagios XI 5.9.2

Updated

  • Made several improvements to RHEL/CentOS 8/9 compatibility -SAW,LG

Fixed

  • Fixed issues with missing timestamp with rrdtool xport [GL:XI#1] -LG
  • Fixed issues with NRPE 4.1.0 Upgrade – [GL:XI#26] -SAW
  • Fixed insecure auth token generation (Thanks to Kevin Joensen of CSIS for reporting this) -SAW

Nagios XI 5.9.1

Fixed

  • Fixed issues with MySQL tuning on Ubuntu 22 systems not adding the proper values in the config -JO
  • Fixed problem with SNMP traps in Ubuntu 22 not working properly due to permissions -JO

Component Updates

Core Config Manager (CCM) 3.1.9

  • Fixed issue with newer PHP 8+ systems having PHP fatal errors when editing objects -JO

Nagios XI 5.9.0

Security

  • Updated NRPE to 4.1.0 for security fixes -SAW

Updated

  • Updated PHP versions supported to include 8.0 and 8.1 -JO
  • Updated php.ini config options for new installs to have better defaults -JO

Added

  • Added support for CentOS 9 Stream / RHEL 9 and Ubuntu 22 systems -JO

Nagios XI 5.8.10

Updated

  • Updated max_connections, max_open_files, disable_log_bin in mysql_tune.sh -SAW
  • Updated install to give an error message on RHEL 8 systems when codeready-builder repo does not exist -JO

Fixed

  • Fixed issue where sometimes SID stored in $_COOKIE could cause invalid login token error until clearing cookies [TPS#15632] -JO
  • Fixed issue with SLA report causing not authorized error when selecting [Host Only] option [TPS#15734] -JO
  • Fixed an issue with previous cacerts directory fix [TPS#15713] -JO
  • Fixed issue with snmptt_service_results.php where it could create a file in place of the nagios.cmd pipe [TPS#15747] -JO
  • Fixed error in AD/LDAP integration where cert directory wasn’t properly being set on Ubuntu/Debian systems -JO

Component Updates

Core Config Manager (CCM) 3.1.8

  • Fixed issue with contact deletion where host/service configs were not being re-written on apply config [TPS#15744] -JO

Nagios XI 5.8.9

Security

  • Updated users account settings to require password confirmation to change email (CVE-2022-29270) (Thanks Alwin Warringa) -JO
  • Updated admin account settings to require password confirmation to change password and email (CVE-2022-29270) (Thanks Alwin Warringa) -JO
  • Fixed stored XSS security issue in Nagios BPI with the info URL not being escaped properly -JO
  • Fixed stored XSS security issue with command names having no encoding in the apply config error text -JO
  • Fixed stored XSS related to update checking -SAW
  • Fixed redirect on login page where redirect parameter urls could redirect user externally after login (CVE-2022-29272) (Thanks Alwin Warringa) -JO
  • Fixed scheduled report/send report email script allowing HTML code to be used in the message field (CVE-2022-29269) (Thanks Alwin Warringa) -JO
  • Fixed scheduled downtime page allowing read-only users to submit downtimes via crafted POST requests (CVE-2022-29271) (Thanks Alwin Warringa) -JO

Updated

  • Updated automysqlbackup script to default root mysql password if none is set [TPS#15739] -JO

Added

  • Added peer verification when loading external URLs -SAW

Fixed

  • Fixed issue in 5.8.0 upgrade for Debian and Ubuntu users -SAW

Component Updates

Core Config Manager (CCM) 3.1.7

  • Fixed copying of service object not copying excludes for Host/Hostgroups [TPS#15732] -JO
  • Fixed reflected XSS security issue in lock page Cancel button not urlencoding the returnurl value -JO
  • Properly fixed XSS security issue in search input on audit log page (thanks Hieu Tran(jkana101) from VCB STeam)) -JO

Full changelog as Markdown