CVE-2024-13995: Nagios XI < 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information Disclosure
Nagios XI versions prior to 2024R1.1.2 may (confirmed in 2024R1.1 and 2024R1.1.1) disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nagios XIto a version that resolves this vulnerability.Fixed in 2024R1.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13995?
CVE-2024-13995 has been classified as a medium severity vulnerability due to its potential to expose sensitive user information.
How do I fix CVE-2024-13995?
To mitigate CVE-2024-13995, update Nagios XI to version 2024R1.1.2 or later.
What kind of data is exposed in CVE-2024-13995?
CVE-2024-13995 may expose sensitive user account information, including API keys and hashed passwords.
Who is affected by CVE-2024-13995?
CVE-2024-13995 affects users of Nagios XI versions prior to 2024R1.1.2.
What is the risk of not addressing CVE-2024-13995?
Failing to address CVE-2024-13995 could lead to unauthorized access to sensitive user account data, increasing the risk of account compromise.