4.9

CVE-2025-34270

Nagios Log Server < 2024R2.0.2 AD/LDAP Import Password Not Obfuscated

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field during import. As a result, the plaintext password supplied for imported accounts may be exposed in the user interface, logs, or other diagnostic output. This can leak sensitive credentials to administrators or anyone with access to import results.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nagios ≫ Log Server Version < 2024
Nagios ≫ Log Server Version 2024 Update r1
Nagios ≫ Log Server Version 2024 Update r1.0.1
Nagios ≫ Log Server Version 2024 Update r1.0.2
Nagios ≫ Log Server Version 2024 Update r1.1
Nagios ≫ Log Server Version 2024 Update r1.2
Nagios ≫ Log Server Version 2024 Update r1.3
Nagios ≫ Log Server Version 2024 Update r1.3.1
Nagios ≫ Log Server Version 2024 Update r1.3.2
Nagios ≫ Log Server Version 2024 Update r1.3.3
Nagios ≫ Log Server Version 2024 Update r1.3.4
Nagios ≫ Log Server Version 2024 Update r1.3.5
Nagios ≫ Log Server Version 2024 Update r2
Nagios ≫ Log Server Version 2024 Update r2.0.1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.58% 0.444
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.9 1.2 3.6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
disclosure@vulncheck.com 6.9 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-312 Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

https://www.nagios.com/changelog/#log-server
Release Notes
https://support.nagios.com/kb/article/authenticating-and-importing-users-with-ad-and-ldap-995.html
Not Applicable
https://www.vulncheck.com/advisories/nagios-log-server-ad-ldap-import-password-not-obfuscated
Third Party Advisory
https://www.nagios.com/products/security/#log-server-2024R2
Vendor Advisory