CVE-2025-34283: Nagios XI < 2024R1.4.2 API Key Disclosure via Neptune Themes
Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nagios XIto a version that resolves this vulnerability.Fixed in 2024R1.4.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34283?
CVE-2025-34283 is considered a medium severity vulnerability due to the potential exposure of API keys to unauthorized users.
How do I fix CVE-2025-34283?
To fix CVE-2025-34283, upgrade Nagios XI to version 2024R1.4.2 or later.
Who is affected by CVE-2025-34283?
CVE-2025-34283 affects authenticated users of Nagios XI versions prior to 2024R1.4.2 using Neptune themes.
What are the potential impacts of CVE-2025-34283?
The potential impacts of CVE-2025-34283 include unauthorized access to API keys, which can compromise sensitive data.
Is CVE-2025-34283 a remote vulnerability?
CVE-2025-34283 is not a remote vulnerability; it requires authenticated access to the Nagios XI application.