CVE-2021-35237: Clickjacking Vulnerability
First published: Fri Oct 29 2021(Updated: )
A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server. This is an attack on both the user and the server.
Credit: psirt@solarwinds.com psirt@solarwinds.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Solarwinds Kiwi Syslog Server | <=9.7.2 |
Remedy
SolarWinds has fixed the vulnerability by configuring the X-Frame-Options header. It is recommended that Kiwi Syslog Server customers to upgrade to the latest version (9.8) once it becomes generally available which now uses Microsoft IIS as the web server.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-35237?
CVE-2021-35237 is a vulnerability that results from a missing HTTP header (X-Frame-Options) in Kiwi Syslog Server, leaving customers vulnerable to clickjacking attacks.
What is clickjacking?
Clickjacking is an attack where an attacker uses a transparent iframe to trick users into clicking on elements that perform unintended actions.
How does CVE-2021-35237 affect Solarwinds Kiwi Syslog Server?
CVE-2021-35237 affects Solarwinds Kiwi Syslog Server version 9.7.2 and earlier by not including the necessary X-Frame-Options HTTP header, making it vulnerable to clickjacking attacks.
What is the severity of CVE-2021-35237?
CVE-2021-35237 has a severity rating of medium with a score of 4.3 out of 10.
How can I mitigate the vulnerability in Kiwi Syslog Server?
To mitigate the vulnerability, upgrade Kiwi Syslog Server to version 9.8 or later, which includes the necessary X-Frame-Options HTTP header to protect against clickjacking attacks.
- collector/nvd-index
- agent/references
- agent/author
- agent/softwarecombine
- agent/type
- agent/weakness
- agent/title
- agent/severity
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/event
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/solarwinds
- canonical/solarwinds kiwi syslog server
- version/solarwinds kiwi syslog server/9.7.2