virus logo Intrusion Prevention

Nagios.Log.Server.Mail.Settings.Stored.XSS

description-logoDescription

This indicates an attack attempt to exploit a Cross-Site Scripting Vulnerability in Nagios Enterprises Log Server.
The vulnerability is due to insufficient validation of user input in HTTP requests submitted to mail.php endpoint. A remote authenticated attacker can exploit this vulnerability by sending a crafted request to the server. Successful exploitation could result in the execution of script code in security context of the target user's browser.

affected-products-logoAffected Products

Nagios Enterprises Log Server 2.1.7 and before

Impact logoImpact

System Compromise: Remote attackers can execute arbitrary script code in the context of the affected application.

recomended-action-logoRecommended Actions

Nagios Enterprises has not released an advisory or patch regarding this vulnerability.

Telemetry logoTelemetry

Coverage

IPS (Regular DB)
IPS (Extended DB)

Version Updates

Date Version Detail
2021-02-25 17.023 Sig Added
2021-01-05 16.991 Default_action:pass:drop
2020-12-22 16.984
ID 49687
Created Dec 14, 2020
Updated May 04, 2022
Risk black-background-circle-icon black-background-circle-icon black-background-circle-icon black-background-circle-icon lightgray-background-circle-icon
Default Action drop
Active
Affected OS Linux, BSD
Affected App Other