PT-2021-20859 · Unknown · Kiwi Syslog Server

Published 2021-10-29 · Updated 2024-09-16 · CVE-2021-35237

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Kiwi Syslog Server (affected versions not specified)

Description: A missing HTTP header (X-Frame-Options) has left customers vulnerable to clickjacking. Clickjacking is an attack where an attacker uses a transparent iframe to trick a user into clicking on an actionable item, such as a button or link, to another server with an identical webpage. The attacker hijacks the user activity intended for the original server and sends them to the other server, attacking both the user and the server.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2021-35237

Affected Products

Kiwi Syslog Server

References · 6

• https://osv.dev/vulnerability/CVE-2021-35237 · Vendor Advisory
• https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35237 · Security Note
• https://solarwinds.com/trust-center/security-advisories/cve-2021-35237 · Vendor Advisory
• https://t.me/cibsecurity/31461 · Telegram Post
• https://t.me/cvenotify/55732 · Telegram Post