Nagios Log Server Cross-Site Scripting Vulnerability in Snapshots Page

A cross-site scripting (XSS) vulnerability has been identified in Nagios Log Server versions prior to 2.1.14. This issue arises on the Snapshots Page, where untrusted log content was not properly encoded for the output context. As a result, attacker-controlled data in the logs could execute scripts in the context of the victim's browser, within the application origin.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's session.

Remediation

Users can upgrade to Nagios Log Server version 2.1.14 or later to address this vulnerability.