CVE-2016-15049 Nagios Log Server < 1.4.2 Dashboards Logs Table XSS
MediumCVSS 5.1
EPSS 0.51%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Nagios Log Server versions prior to 1.4.2 are vulnerable to cross-site scripting (XSS) in the Dashboards section when rendering log entries in the Logs table. Untrusted log content was not safely encoded for the output context, allowing attacker-controlled data present in logs to execute script in the victim’s browser within the application origin.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nagios Log Server | < 1.4.2 | 1.4.2 |
References
- www.nagios.com patch release-notes
- www.vulncheck.com third-party-advisory