8.8

CVE-2025-34298

Nagios Log Server < 2024R1.3.2 Set Email Privilege Escalation

Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own email to an invalid value and, due to insufficient validation and authorization checks tied to email identity state, trigger inconsistent account state that granted elevated privileges or bypassed intended access controls.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nagios ≫ Log Server Version < 2024
Nagios ≫ Log Server Version 2024 Update r1
Nagios ≫ Log Server Version 2024 Update r1.0.1
Nagios ≫ Log Server Version 2024 Update r1.0.2
Nagios ≫ Log Server Version 2024 Update r1.1
Nagios ≫ Log Server Version 2024 Update r1.2
Nagios ≫ Log Server Version 2024 Update r1.3
Nagios ≫ Log Server Version 2024 Update r1.3.1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.66% 0.477
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
disclosure@vulncheck.com 8.7 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-281 Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

https://www.nagios.com/changelog/nagios-log-server-2024r1/
Release Notes
https://www.vulncheck.com/advisories/nagios-log-server-set-email-privilege-escalation
Third Party Advisory