Medium severity · published Jul 30, 2021
CVE-2021-35478
Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function
5.4
CVSS
76.6%
EPSS
No
On KEV
Description
Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affects users who open a crafted link or third-party web page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)76.6% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LS
Log Server · Nagios
before 2.1.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-35478
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-35478
Exploit
https://research.nccgroup.com/2021/07/22/technical-advisory-stored-and-reflected-xss-vulnerability-in-nagios-log-server-cve-2021-35478cve-2021-35479/
Third Party Advisory
https://research.nccgroup.com/?research=Technical%20advisories
Release Notes
https://www.nagios.com/downloads/nagios-log-server/change-log/
More from Log Server
9.8
CVE-2025-34277
Nagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard ID
9.8
CVE-2025-34274
Nagios Log Server < 2024R2.0.3 Logstash Process Root Privileges
9.8
CVE-2025-34271
Nagios Log Server < 2024R2.0.2 Cluster Manager Credential Requests Sent Over Plaintext
8.8
CVE-2025-34298
Nagios Log Server < 2024R1.3.2 Set Email Privilege Escalation
8.8
CVE-2025-44823
Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call