CVE-2021-35237mediumCWE-1021

CVE-2021-35237: medium-severity vulnerability in SolarWinds Kiwi Syslog Server

Clickjacking Vulnerability

Published · Updated

Follow this CVE+ Monitor Kiwi Syslog Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5epss 1.0%
In short

Kiwi Syslog Server is missing a security header that prevents clickjacking attacks, where attackers trick users into clicking hidden buttons or links by overlaying a fake webpage on top of the real one.

Technical detail

The absence of the X-Frame-Options HTTP header allows the application to be embedded in iframes, enabling clickjacking attacks where an attacker overlays a transparent frame to hijack user interactions intended for the legitimate server. This requires user interaction and affects the confidentiality and integrity of user actions.

Summary generated and translated by AI from the official description.
A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server. This is an attack on both the user and the server.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected products
SolarWinds · Kiwi Syslog Server
Related CVEs — SolarWinds Kiwi Syslog Server

In the same product, most dangerous first.

CVE-2021-35235MEDIUMASP.NET Debug Feature EnabledEPSS 1.3%CVE-2021-35233MEDIUMHTTP TRACK & TRACE Methods EnabledEPSS 1.0%CVE-2021-35236LOWMissing Secure Flag From SSL CookieEPSS 0.5%CVE-2021-35231MEDIUMUnquoted Path (SMB Login) VulnerabilityEPSS 0.3%