CVE-2021-35478: Nagios Log Server reflected XSS in alert history and audit log filters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityReflected XSS requires user interaction and low privileges, but public exploit detail and a very high EPSS score raise the practical risk.

What it is

Nagios Log Server before 2.1.9 reflects unfiltered input in the dropdown box used for alert history and audit log filtering, allowing reflected cross-site scripting. Because all filter parameters are affected, an attacker can craft a link or third-party page that executes script in a victim's browser within the application context.

Impact

An attacker can run arbitrary script in the session of an authenticated Nagios Log Server user, enabling theft of session data or actions performed as that user. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through crafted URLs or third-party web pages that supply malicious filter parameters; the CVSS vector requires low privileges (PR:L) and user interaction (UI:R), so a victim must open the crafted link or page.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high (0.766, 99.5th percentile) and a reference is tagged Exploit, indicating public exploit detail exists.

What to do

• Upgrade Nagios Log Server to 2.1.9 or later per the vendor change log.
• If immediate upgrade is not possible, restrict access to the alert history and audit log interfaces to trusted networks and users.
• Encode or validate all filter parameters server-side and apply a strict Content-Security-Policy to limit script execution.
• Train users not to open unsolicited links to Nagios Log Server filter pages.
• Review logs for suspicious filter parameter values reaching the alert history and audit log endpoints.

Detection

• Search web logs for encoded script payloads or HTML tags in alert history and audit log filter parameters.
• Alert on requests containing script, onerror, or javascript: patterns in query strings to Nagios Log Server endpoints.
• Monitor for unusual outbound requests or session anomalies from authenticated Nagios Log Server users following filter page access.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.