CVE-2025-34298: Nagios Log Server < 2024R1.3.2 Set Email Privilege Escalation
Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own email to an invalid value and, due to insufficient validation and authorization checks tied to email identity state, trigger inconsistent account state that granted elevated privileges or bypassed intended access controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nagios Log Serverto a version that resolves this vulnerability.Fixed in 2024R1.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34298?
CVE-2025-34298 is considered a privilege escalation vulnerability, which could allow an attacker to manipulate account email settings.
How do I fix CVE-2025-34298?
To fix CVE-2025-34298, upgrade Nagios Log Server to version 2024R1.3.2 or later.
Who is affected by CVE-2025-34298?
CVE-2025-34298 affects all versions of Nagios Log Server prior to 2024R1.3.2.
What impact does CVE-2025-34298 have?
The impact of CVE-2025-34298 includes potential unauthorized access to accounts through email manipulation.
How can I determine if my Nagios Log Server is vulnerable to CVE-2025-34298?
You can determine if your Nagios Log Server is vulnerable to CVE-2025-34298 by checking if it is running a version prior to 2024R1.3.2.