Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value.
Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control when the 'Allow Insecure Logins' option is enabled. Under this configuration, any user can create valid login credentials for other users without proper authorization. This can lead to unauthorized account creation, privilege escalation, or full compromise of the Nagios XI web interface depending on the target account.
Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory (AD) or LDAP authentication token to an authenticated user. Exposure of the server’s AD/LDAP token could allow domain-wide authentication misuse, escalation of privileges, or further compromise of network-integrated systems.
CVE-2023-7319 is a medium-severity cross-site scripting (XSS) vulnerability affecting Nagios Network Analyzer versions prior to 2024R1. The flaw exists in the Percentile Calculator menu due to improper input validation and escaping, allowing attackers to inject malicious scripts that execute in the context of a victim's browser. Exploitation requires no authentication but does require user interaction, such as clicking a crafted link. While no known exploits are currently reported in the wild, successful attacks could lead to session hijacking, credential theft, or unauthorized actions within the application. The vulnerability has a CVSS 4.0 base score of 5.1, reflecting moderate impact and ease of exploitation. European organizations using Nagios Network Analyzer should prioritize patching or mitigating this issue to prevent potential compromise. Countries with significant Nagios Network Analyzer adoption and critical infrastructure monitoring are at higher risk. Mitigation includes applying vendor updates upon release, implementing strict input validation, employing Content Security Policy (CSP), and educating users about phishing risks.
CVE-2025-34278 is a stored cross-site scripting (XSS) vulnerability in Nagios Network Analyzer versions prior to 2024R1, specifically in the Source Groups page's percentile calculator menu. An attacker can inject malicious scripts that are stored by the application and executed in the browsers of users who view the affected page. This vulnerability requires low privileges to exploit and user interaction to trigger the payload. The CVSS 4.0 score is 5.1, indicating a medium severity level. There are no known exploits in the wild currently, and no patches have been published yet. The vulnerability impacts confidentiality and integrity by enabling script execution in victim browsers, potentially leading to session hijacking or unauthorized actions. European organizations using Nagios Network Analyzer should prioritize input validation and restrict access to vulnerable pages until a patch is available. Countries with significant IT infrastructure and Nagios user bases, such as Germany, the UK, France, and the Netherlands, are more likely to be affected.
Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management functionality whereby the certificate removal operation fails to apply adequate input sanitation. An authenticated administrator can trigger command execution on the underlying host in the context of the web application service, resulting in remote code execution with the service's privileges.
CVE-2023-7321 is a medium-severity cross-site scripting (XSS) vulnerability affecting Nagios Log Server versions prior to 2.1.14. The issue arises from improper encoding of untrusted log content on the Snapshots Page, allowing attacker-supplied data in logs to execute scripts in users' browsers within the application origin. Exploitation requires no authentication but does require user interaction, such as viewing a maliciously crafted snapshot. While no known exploits are currently in the wild, the vulnerability could enable attackers to perform actions like session hijacking or delivering malicious payloads to users. European organizations using Nagios Log Server should prioritize patching to mitigate risks. Countries with significant Nagios usage and critical infrastructure monitoring are at higher risk. Mitigation includes upgrading to version 2.1.
CVE-2023-7323 is a medium-severity cross-site scripting (XSS) vulnerability affecting Nagios Log Server versions prior to 2024R1. The flaw exists in the Create User function due to improper neutralization of user input, allowing attackers to inject malicious scripts that execute in the victim's browser context. Exploitation requires low privileges and user interaction but no authentication. While no known exploits are currently reported in the wild, successful attacks could lead to session hijacking, credential theft, or unauthorized actions within the affected web application. European organizations using vulnerable Nagios Log Server versions are at risk, especially those in critical infrastructure and IT monitoring roles. Mitigation involves upgrading to version 2024R1 or later and implementing strict input validation and output encoding on user-supplied data. Countries with significant Nagios deployments and critical infrastructure monitoring, such as Germany, France, and the UK, are most likely to be affected. Due to the medium CVSS score and the nature of the vulnerability, organizations should prioritize patching to prevent potential exploitation.
Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own email to an invalid value and, due to insufficient validation and authorization checks tied to email identity state, trigger inconsistent account state that granted elevated privileges or bypassed intended access controls.
CVE-2025-34277 is a critical code injection vulnerability in Nagios Log Server versions prior to 2024R1.3.1. It arises from improper validation of dashboard ID inputs, allowing attackers to inject and execute arbitrary code within the Log Server process. The vulnerability requires no user interaction but does require low-level privileges, making exploitation feasible in environments where an attacker has limited access. Successful exploitation can lead to full compromise of the affected system, impacting confidentiality, integrity, and availability. No public exploits are known yet, but the high CVSS score (9.4) indicates severe risk. European organizations using Nagios Log Server should prioritize patching and implement strict input validation and monitoring controls. Countries with significant Nagios deployments and critical infrastructure reliance on this product are at higher risk.
CVE-2025-34272 is a medium-severity vulnerability in Nagios Log Server versions prior to 2024R2.0.3. When a user's configured default dashboard is deleted, the application may incorrectly display another user's dashboard as the default, potentially exposing sensitive information or privileges. This occurs due to improper fallback handling in the dashboard selection logic. The vulnerability does not require user interaction or authentication beyond low privileges, and it can be exploited remotely over the network. Although no known exploits are currently in the wild, affected organizations should prioritize patching to prevent unauthorized data exposure. European organizations using Nagios Log Server for log management and monitoring are at risk, especially those with complex dashboard sharing policies. Countries with high adoption of Nagios products and critical infrastructure monitoring are more likely to be targeted. Mitigation involves updating to version 2024R2.
CVE-2025-34273 is a high-severity incorrect authorization vulnerability in Nagios Log Server versions prior to 2024R2.0.3. It allows non-administrator users to delete global dashboards due to improper enforcement of authorization checks. This flaw can disrupt monitoring visibility for all users by removing shared dashboards critical to organizational operations. The vulnerability requires only low privileges and no user interaction, making exploitation relatively straightforward. Although no known exploits are reported in the wild, the impact on availability and integrity of monitoring data is significant. European organizations relying on Nagios Log Server for centralized log management and monitoring are at risk, especially those with multi-user environments. Mitigation involves upgrading to version 2024R2.0.
CVE-2024-58273 is a high-severity local privilege escalation vulnerability in Nagios Log Server versions prior to 2024R1.0.2. It allows an attacker with the ability to execute commands as the Apache web user or backend shell user to escalate privileges to root on the host system. The vulnerability stems from incorrect privilege assignment (CWE-266), enabling unauthorized elevation of privileges without user interaction. Exploitation requires local access with limited privileges but no authentication bypass or user interaction. No known exploits are currently reported in the wild. This vulnerability poses a significant risk to systems running affected Nagios Log Server versions, especially in environments where the Apache user has command execution capabilities. European organizations using Nagios Log Server should prioritize patching to prevent potential root compromise. The CVSS 4.
CVE-2025-34274 is a critical vulnerability in Nagios Log Server versions prior to 2024R2.0.3 where the embedded Logstash process runs with root privileges. An attacker exploiting this flaw via insecure plugins, pipeline configuration injection, or input parsing vulnerabilities could execute arbitrary code with root access, leading to full system compromise. The vulnerability arises from execution with unnecessary privileges (CWE-250). Nagios has mitigated this risk in newer versions by running Logstash under a lower-privileged 'nagios' user. The CVSS 4.0 score is 9.3, reflecting the high impact and ease of exploitation without authentication or user interaction. European organizations using affected Nagios Log Server versions face significant risks, especially critical infrastructure and enterprises relying on this logging solution.
CVE-2023-7322 is a high-severity incorrect authorization vulnerability in Nagios Log Server versions prior to 2024R1. Authenticated users with limited privileges can exploit this flaw to access or modify data and perform actions beyond their authorization via the API. The vulnerability arises from improper authorization checks on API endpoints, allowing privilege escalation without requiring user interaction or elevated authentication. Although no known exploits are currently reported in the wild, the vulnerability's CVSS score of 8.7 indicates a significant risk. European organizations using Nagios Log Server for log management and monitoring could face data confidentiality and integrity breaches, as well as potential disruption of monitoring services. Mitigation requires prompt upgrading to version 2024R1 or later, strict API access controls, and monitoring of user activities. Countries with high adoption of Nagios products and critical infrastructure monitoring, such as Germany, France, and the UK, are particularly at risk. Given the ease of exploitation and the broad impact on data and system integrity, this vulnerability demands urgent attention from defenders.
CVE-2025-34271 is a high-severity vulnerability in Nagios Log Server versions prior to 2024R2.0.2 affecting the cluster manager component. The flaw involves cleartext transmission of sensitive credentials between cluster nodes over unencrypted channels, even when SSL/TLS is enabled. An attacker with network access can intercept these credentials, potentially allowing unauthorized authentication as a cluster node or service account. This can lead to lateral movement, unauthorized access, and system compromise within affected environments. No known exploits are currently reported in the wild. The vulnerability has a CVSS 4.0 base score of 8.7, reflecting its high impact and ease of exploitation without authentication or user interaction.
CVE-2025-34270 is a medium severity vulnerability in Nagios Log Server versions prior to 2024R2.0.2 affecting the AD/LDAP user import functionality. The flaw causes plaintext passwords supplied during user import to be stored or displayed without obfuscation, exposing sensitive credentials in the user interface, logs, or diagnostic outputs. This exposure risks credential leakage to administrators or any users with access to these outputs. The vulnerability requires privileged access to exploit and does not need user interaction. Although no exploits are currently known in the wild, the vulnerability could facilitate unauthorized access if exposed. Organizations using affected Nagios Log Server versions should update promptly and restrict access to import results and logs. European organizations with deployments of Nagios Log Server, especially in critical infrastructure or large enterprises, are at risk. Countries with significant Nagios usage and strong regulatory environments around data protection should prioritize mitigation.
CVE-2023-53689 is a reflected cross-site scripting (XSS) vulnerability in Nagios Fusion versions prior to 4.2.0, specifically in the license key configuration flow. An attacker can craft a malicious URL that, when visited by an authenticated user with administrative privileges, executes attacker-controlled scripts in the user's browser. This can lead to session or credential theft and unauthorized administrative actions, although the server itself is not directly compromised. The vulnerability requires user interaction and high privileges but no authentication bypass. It has a CVSS score of 6.0 (medium severity). European organizations using Nagios Fusion for IT infrastructure monitoring should prioritize patching or mitigating this issue to prevent browser-based attacks targeting administrators.
CVE-2023-53690 is a stored cross-site scripting (XSS) vulnerability affecting Nagios Fusion versions prior to 4.2.0. The flaw exists in the LDAP/AD authentication-server configuration, where unsanitized user input can be stored and later rendered in the administrative UI. This allows an attacker with privileges to add authentication servers to inject malicious JavaScript that executes in the browsers of other users viewing the affected page. Exploitation requires high privileges to add LDAP/AD servers and user interaction to trigger the payload. The vulnerability has a CVSS 4.0 score of 6.2, indicating medium severity. No known exploits are currently reported in the wild.
