Nagios Log Server Cross-Site Scripting Vulnerability in Dashboards Logs Table

A cross-site scripting (XSS) vulnerability has been identified in Nagios Log Server versions prior to 1.4.2. The issue arises in the Dashboards section while rendering log entries in the Logs table. Untrusted log content was not properly encoded for the output context, allowing attacker-controlled data in the logs to execute scripts in the victim's browser within the application origin.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to Nagios Log Server version 1.4.2 or later to address this vulnerability.