CVE-2020-6586
Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 19.0%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 19.03% probability · 97th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- nagios/nagios
- Source
- cve@mitre.org
EPSS 19.0% since 27 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://assets.nagios.com/downloads/nagios-log-server/CHANGES.TXTRelease Notes, Vendor Advisory
- https://medium.com/%40fixitt6/multiple-vulnerabilities-in-nagios-log-server-2-1-3-af7c160edc60
- https://www.nagios.com/products/nagios-log-server/Product
- https://assets.nagios.com/downloads/nagios-log-server/CHANGES.TXTRelease Notes, Vendor Advisory
- https://medium.com/%40fixitt6/multiple-vulnerabilities-in-nagios-log-server-2-1-3-af7c160edc60
- https://www.nagios.com/products/nagios-log-server/Product
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.