Security readout for executives and security teams
Plain-English summary
Older versions of Nagios XI, a popular IT monitoring product, contain a cross-site scripting flaw on the Audit Log page. An attacker who can already log in could plant rigged content that runs scripts in another user's browser when they view the page, potentially hijacking that user's session inside the monitoring console.
Executive priority
Schedule a routine patch cycle. Risk is moderate and contingent on an authenticated insider abusing the flaw against another user. Prioritize upgrade where Nagios XI is broadly accessible or holds elevated operational trust.
Technical view
CVE-2021-47699 is a stored or reflected XSS (CWE-79) in Nagios XI before 5.8.7, located in the Audit Log page's "Send to NLS" form. Insufficient input validation or output encoding lets an authenticated low-privileged attacker inject script that executes in a victim's browser context, requiring user interaction. CVSS 4.0 base score is 5.1 (medium).
Likely exposure
Exposure is limited to organizations running Nagios XI versions earlier than 5.8.7 where the monitoring console is reachable by users who can be tricked into viewing the Audit Log. Internet-exposed Nagios XI portals or shared admin tooling raise exposure; isolated, current installs do not.
Exploitation context
Not listed in CISA KEV and no cited source confirms active exploitation. The CVSS vector requires authenticated low-privileged access plus victim interaction, and impact is constrained to confidentiality and integrity within the browser session. Treat as a credential- or session-theft risk path, not a remote takeover.
Researcher notes
Vector indicates AV:N/PR:L/UI:P with confidentiality and integrity impact only on the subsequent system (browser session), aligning with classic XSS. No public PoC is cited in the bundle and KEV is false. VulnCheck advisory and Nagios changelog are the primary references; CPEs are empty so version-matching relies on changelog text.
Mitigation direction
- Upgrade Nagios XI to 5.8.7 or later per the vendor changelog.
- Restrict Audit Log access and NLS form usage to trusted administrators only.
- Place the Nagios XI console behind VPN or SSO with MFA to reduce attacker reach.
- Review vendor guidance for any interim hardening notes if upgrade is delayed.
- Rotate session cookies and admin credentials after patching as a precaution.
Validation and detection
- Confirm installed Nagios XI version against the 5.8.7 fix line in the changelog.
- Inventory all Nagios XI instances, including dev, staging, and DR copies.
- Review Audit Log entries for unexpected script-like content or unusual NLS submissions.
- Check web access logs for suspicious requests to the Audit Log or Send to NLS endpoints.
- Verify CSP, HttpOnly, and SameSite settings on Nagios XI session cookies.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47699 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.1MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.nagios.com/changelog/nagios-xi/CVE reference · release-notes, patch
- https://www.vulncheck.com/advisories/nagios-xi-xss-in-audit-log-via-send-to-nls-formCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.