First published: Mon Mar 16 2020(Updated: )
Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Nagios Nagios | =2.1.3 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2020-6586 is a vulnerability in Nagios Log Server 2.1.3 that allows XSS attacks by visiting the /profile page and entering a crafted name field.
An attacker can exploit CVE-2020-6586 by entering an XSS payload in the Name field on the /profile page and waiting for an admin to view it on the /admin/users page.
CVE-2020-6586 has a severity rating of medium, with a CVSS score of 5.4.
To fix CVE-2020-6586, users should upgrade to a version of Nagios Log Server that is not affected by the vulnerability.
You can find more information about CVE-2020-6586 in the change log of Nagios Log Server, as well as in the provided references.