CVE-2021-4285 - CVE House

Back to Database

Status published Low CVE-2021-4285

Nagios NCPA tail.html cross site scripting

3.5 CVSS

Vulnerability Description

A vulnerability classified as problematic was found in Nagios NCPA. This vulnerability affects unknown code of the file agent/listener/templates/tail.html. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 2.4.0 is able to address this issue. The name of the patch is 5abbcd7aa26e0fc815e6b2b0ffe1c15ef3e8fab5. It is recommended to upgrade the affected component. VDB-216874 is the identifier assigned to this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-4285

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Nagios

View All →

Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only...

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve...

Nagios Log Server < 2026R1.0.1 Local Privilege Escalation via Writable Scripts and Sudo Rules

Nagios Log Server < 2026R1.0.1 Authenticated Command Injection via Natural Language Queries

Nagios Log Server < 2024R1.3.2 Set Email Privilege Escalation

Affected Vendor

Nagios

View all reports →

Affected Software

NCPA

Vulnerable Versions:

Unknown

Timeline

Official Publish: December 27th, 2022

Last Modified: August 3rd, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement