Security readout for executives and security teams
Plain-English summary
CVE-2021-35479 is a cross-site scripting issue in Nagios Log Server before 2.1.9. A crafted link or third-party page can affect users who view the alert history or audit log custom column view, potentially causing attacker-controlled script to run in their browser session.
Executive priority
Treat as a timely maintenance and exposure-reduction issue, not an emergency based on current evidence. Prioritize upgrade if Nagios Log Server is used by privileged operations staff or is broadly reachable.
Technical view
Nagios Log Server before 2.1.9 contains stored XSS in the custom column view for alert history and audit log through the affected pp parameter. The provided sources do not include CVSS, CWE, privilege, authentication, or detailed impact data.
Likely exposure
Exposure is limited to Nagios Log Server deployments running versions earlier than 2.1.9. Risk is most relevant for users who access alert history or audit log views and can be induced to open a crafted link or third-party web page.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation evidence. Public advisory coverage exists, but the provided facts only support a user-interaction XSS scenario, not confirmed exploitation in the wild.
Researcher notes
Evidence is sparse: no CVSS, CWE, exploit status, or detailed preconditions are provided in the bundle. Keep analysis tied to the pp parameter, custom column view, alert history, audit log, and pre-2.1.9 version boundary.
Mitigation direction
- Upgrade Nagios Log Server to version 2.1.9 or later.
- Review Nagios release notes and NCC advisory for vendor guidance.
- Restrict Nagios Log Server access to trusted administrative networks.
- Warn administrators not to open untrusted links while authenticated.
- Monitor vendor sources for any later corrective guidance.
Validation and detection
- Inventory Nagios Log Server instances and record installed versions.
- Confirm all instances are version 2.1.9 or later.
- Identify users with access to alert history and audit log views.
- Review logs for suspicious use around alert history or audit log pages.
- Check whether Nagios access is restricted to trusted users and networks.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-35479 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.nagios.com/downloads/nagios-log-server/change-log/CVE reference · x_refsource_MISC
- https://research.nccgroup.com/?research=Technical%20advisoriesCVE reference · x_refsource_MISC
- https://research.nccgroup.com/2021/07/22/technical-advisory-stored-and-reflected-xss-vulnerability-in-nagios-log-server-cve-2021-35478cve-2021-35479/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.