PT-2021-20926 · Nagios · Nagios Log Server

Published 2021-07-27 · Updated 2022-02-10 · CVE-2021-35479

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Nagios Log Server versions prior to 2.1.9

Description: The issue affects users who open a crafted link or third-party web page, allowing for Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter. Additionally, Reflected XSS is possible in the dropdown box for the alert history and audit log function, where all parameters used for filtering are affected.

Recommendations: For versions prior to 2.1.9, update to version 2.1.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the custom column view for the alert history and audit log function until a patch is available. Avoid using the pp parameter in the affected function until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-35479

Affected Products

Nagios Log Server

References · 7

• 🔥 https://research.nccgroup.com/2021/07/22/technical-advisory-stored-and-reflected-xss-vulnerability-in-nagios-log-server-cve-2021-35478cve-2021-35479 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-35479 · Security Note
• https://nagios.com/downloads/nagios-log-server/change-log · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-35479 · Vendor Advisory
• https://t.me/cvenotify/18811 · Telegram Post
• https://research.nccgroup.com/?research=Technical%20advisories · Note
• https://t.me/cibsecurity/26621 · Telegram Post