by Kastro
Paper/Archive/CVE-2024-13994

CVE-2024-13994

Nagios XI — Nagios XI < 2024R1.1.2 Allow Insecure Logins Missing Authorization

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 60.1.601 × 2012.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control when the 'Allow Insecure Logins' option is enabled. Under this configuration, any user can create valid login credentials for other users without proper authorization. This can lead to unauthorized account creation, privilege escalation, or full compromise of the Nagios XI web interface depending on the target account.

Affected

ProductAffectedFixed inSource
XI< 2024R1.1.22024R1.1.2CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchnagios.com/products/security/#nagios-xipatchnagios.com/changelog/nagios-xiwriteupvulncheck.com/advisories/nagios-xi-allow-insecure-logins-missing-authorization