PT-2025-44537 · Nagios · Nagios Log Server

Published 2016-07-22 · Updated 2025-10-30 · CVE-2016-15049

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Nagios Log Server versions prior to 1.4.2

Description A flaw exists in the Nagios Log Server monitoring and log analysis software’s dashboard due to insufficient protection of the web page structure when viewing log entries. This can allow a remote attacker to conduct cross-site scripting (XSS) attacks. The issue occurs in the Dashboards section when rendering log entries in the Logs table, where untrusted log content is not safely encoded for output, enabling attacker-controlled data within logs to execute script in the victim’s browser within the application origin.

Recommendations Update to version 1.4.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-15430

CVE-2016-15049

Affected Products

Nagios Log Server

References · 5

• https://bdu.fstec.ru/vul/2025-15430 · Security Note
• https://osv.dev/vulnerability/CVE-2016-15049 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-15049 · Security Note
• https://vulncheck.com/advisories/nagios-log-server-dashboards-logs-table-xss · Note
• https://nagios.com/changelog/nagios-log-server-2024r1 · Note