Clickjacking in SolarWinds Kiwi Syslog Server
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1021.
Summary
A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server. This is an attack on both the user and the server.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SolarWinds | Kiwi Syslog Server | 9.7.2 and previous versions to before 9.7.2 | 9.7.2 | Patch available | CNA |
- Kiwi Syslog Server VendorSolarWinds Affected 9.7.2 and previous versions to before 9.7.2 Fixed in 9.7.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:solarwinds:kiwi_syslog_server:*:*:*:*:*:*:*:* | up to 9.7.2 | Vulnerable | SolarWinds |
- cpe:2.3:a:solarwinds:kiwi_syslog_server:*:*:*:*:*:*:*:* Versions up to 9.7.2 Vulnerable ·SolarWinds
Remediation
- Fix · CNA Kiwi Syslog Server (SolarWinds) Fixed in 9.7.2
Timeline
- 2026-10-02 Threatist record created from CVE-2021-35237
- 2026-10-03 Alias added: GHSA-7wwf-jwf3-5r2m
References
More SolarWinds Kiwi Syslog Server vulnerabilities
- TI-2021-14124 Unquoted Path (SMB Login) Vulnerability CVSS 3.1MEDIUM 6.7
- TI-2021-14128 ASP.NET Debug Feature Enabled CVSS 3.1MEDIUM 5.3
- TI-2021-14126 HTTP TRACK & TRACE Methods Enabled CVSS 3.1MEDIUM 5.3
- TI-2021-14129 Missing Secure Flag From SSL Cookie CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-35237 · CVE Program
- CVE-2021-35237 · NVD
- FIRST EPSS
- GHSA-7wwf-jwf3-5r2m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences