CVE-2025-34270: Nagios Log Server < 2024R2.0.2 AD/LDAP Import Password Not Obfuscated
Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field during import. As a result, the plaintext password supplied for imported accounts may be exposed in the user interface, logs, or other diagnostic output. This can leak sensitive credentials to administrators or anyone with access to import results.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nagios Log Serverto a version that resolves this vulnerability.Fixed in 2024R2.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34270?
CVE-2025-34270 is classified as a high severity vulnerability due to the potential exposure of plaintext passwords.
How do I fix CVE-2025-34270?
To mitigate CVE-2025-34270, upgrade Nagios Log Server to version 2024R2.0.2 or later.
What does CVE-2025-34270 affect?
CVE-2025-34270 affects Nagios Log Server versions prior to 2024R2.0.2, particularly in the AD/LDAP user import functionality.
What is the impact of CVE-2025-34270?
The impact of CVE-2025-34270 is that imported account passwords may be exposed in the user interface or logs.
Who is most at risk from CVE-2025-34270?
Organizations using vulnerable versions of Nagios Log Server for user management through AD/LDAP are most at risk from CVE-2025-34270.