CVE-2020-16157: XSS
First published: Thu Jul 30 2020(Updated: )
A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nagios Log Server | <2.1.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/158992/Nagios-Log-Server-2.1.6-Cross-Site-Scripting.html
- https://www.getastra.com/blog/911/stored-xss-vulnerability-nagios-log-server/
- https://www.jinsonvarghese.com/stored-xss-vulnerability-in-nagios-log-server/
- https://www.nagios.com/downloads/nagios-log-server/change-log/
Frequently Asked Questions
What is the severity of CVE-2020-16157?
The severity of CVE-2020-16157 is medium with a CVSS score of 5.4.
How does the Stored XSS vulnerability in Nagios Log Server before 2.1.7 occur?
The Stored XSS vulnerability in Nagios Log Server before 2.1.7 occurs via the Notification Methods -> Email Users menu.
What software versions are affected by CVE-2020-16157?
Nagios Log Server versions up to but excluding 2.1.7 are affected by CVE-2020-16157.
Are there any public references available for CVE-2020-16157?
Yes, there are public references available for CVE-2020-16157. You can find them at the following links: http://packetstormsecurity.com/files/158992/Nagios-Log-Server-2.1.6-Cross-Site-Scripting.html, https://www.getastra.com/blog/911/stored-xss-vulnerability-nagios-log-server/, https://www.jinsonvarghese.com/stored-xss-vulnerability-in-nagios-log-server/
Is there a fix available for CVE-2020-16157?
Yes, to fix CVE-2020-16157, you need to update Nagios Log Server to version 2.1.7 or later.
- collector/nvd-index
- agent/weakness
- agent/author
- agent/severity
- agent/references
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/nagios
- canonical/nagios log server