CVEvulnerability
CVE-2021-35478
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-07-30
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affects users who open a crafted link or third-party web page.
Affected configurations
• nagios log server (< 2.1.9)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://research.nccgroup.com/2021/07/22/technical-advisory-stored-and-reflected-xss-vulnerability-in-nagios-log-server-cve-2021-35478cve-2021-35479/ Exploit, Third Party Advisory
- https://research.nccgroup.com/?research=Technical%20advisories Third Party Advisory
- https://www.nagios.com/downloads/nagios-log-server/change-log/ Release Notes, Vendor Advisory
- https://research.nccgroup.com/2021/07/22/technical-advisory-stored-and-reflected-xss-vulnerability-in-nagios-log-server-cve-2021-35478cve-2021-35479/ Exploit, Third Party Advisory
- https://research.nccgroup.com/?research=Technical%20advisories Third Party Advisory
- https://www.nagios.com/downloads/nagios-log-server/change-log/ Release Notes, Vendor Advisory