CVEvulnerability
CVE-2021-35479
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-07-30
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter. This affects users who open a crafted link or third-party web page.
Affected configurations
• nagios log server (< 2.1.9)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://research.nccgroup.com/2021/07/22/technical-advisory-stored-and-reflected-xss-vulnerability-in-nagios-log-server-cve-2021-35478cve-2021-35479/ Exploit, Third Party Advisory
- https://research.nccgroup.com/?research=Technical%20advisories Third Party Advisory
- https://www.nagios.com/downloads/nagios-log-server/change-log/ Vendor Advisory
- https://research.nccgroup.com/2021/07/22/technical-advisory-stored-and-reflected-xss-vulnerability-in-nagios-log-server-cve-2021-35478cve-2021-35479/ Exploit, Third Party Advisory
- https://research.nccgroup.com/?research=Technical%20advisories Third Party Advisory
- https://www.nagios.com/downloads/nagios-log-server/change-log/ Vendor Advisory