CVE-2021-35237

Katalog CVE

CVSS 4.3 · Medium EPSS 0,96%

Kerentanan Improper Restriction of Rendered UI Layers or Frames pada solarwinds kiwi syslog server. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server. This is an attack on both the user and the server.

Rincian

Terbit di NVD

29 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1021: Improper Restriction of Rendered UI Layers or Frames

EPSS (30 hari)

0,96% peluang dieksploitasi; lebih tinggi dari 60,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm release notes · advisory vendor
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35237 advisory vendor