CVE-2021-35478

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affects users who open a crafted link or third-party web page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://research.nccgroup.com/2021/07/22/technical-advisory-stored-and-reflected-xss-vulnerability-in-nagios-log-server-cve-2021-35478cve-2021-35479/Exploit, Third Party Advisory
https://research.nccgroup.com/?research=Technical%20advisoriesThird Party Advisory
https://www.nagios.com/downloads/nagios-log-server/change-log/Release Notes, Vendor Advisory
https://research.nccgroup.com/2021/07/22/technical-advisory-stored-and-reflected-xss-vulnerability-in-nagios-log-server-cve-2021-35478cve-2021-35479/Exploit, Third Party Advisory
https://research.nccgroup.com/?research=Technical%20advisoriesThird Party Advisory
https://www.nagios.com/downloads/nagios-log-server/change-log/Release Notes, Vendor Advisory

Timeline

Published: Jul 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-354795.4Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affect CVE-2021-35487.1A flaw was found in dmg2img through 20170502. dmg2img did not validate the size of the read buffer during memcpy() inside the main() functio CVE-2021-354827.8An issue was discovered in Barco MirrorOp Windows Sender before 2.5.4.70. An attacker in the local network is able to achieve Remote Code Ex CVE-2021-354834.1The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload J CVE-2021-354848.2Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on CVE-2021-354858.0The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload s CVE-2021-354868.1A Cross-Site Request Forgery (CSRF) vulnerability in Nokia IMPACT through 19.11.2.10-20210118042150283 allows a remote attacker to import an CVE-2021-354876.5Nokia Broadcast Message Center through 11.1.0 allows an authenticated user to perform a Boolean Blind SQL Injection attack on the endpoint /CVE-2021-354886.1Thruk 2.40-2 allows /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE] Reflected XSS via the host or title parameter. An attacker could CVE-2021-354896.1Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or CVE-2021-35497.1An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to av CVE-2021-354905.4Thruk before 2.44 allows XSS for a quick command.