PT-2025-44500 · Nagios Enterprises · Nagios Xi

Publicado 2025-10-30 · Atualizado 2025-10-31 · CVE-2024-13999

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.1.3

Description Nagios XI, under certain circumstances, reveals the server's Active Directory (AD) or Lightweight Directory Access Protocol (LDAP) authentication token to a user who is already authenticated. This exposure of the AD/LDAP token could enable unauthorized domain-wide authentication, privilege escalation, or further compromise of network-integrated systems.

Recommendations Update to version 2024R1.1.3 or later.

Correção

Enumeração de Fraquezas

CWE-497

Identificadores relacionados

BDU:2025-14706

CVE-2024-13999

Produtos afetados

Nagios Xi

Referências · 9

• https://nagios.com/products/security/#nagios-xi · Correção, Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1984129520547295696 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1984012706957992169 · Publicação no Twitter
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44500 · Nota
• https://osv.dev/vulnerability/CVE-2024-13999 · Aviso do Fabricante
• https://vulncheck.com/advisories/nagios-xi-ad-ldap-token-authenticated-information-disclosure · Nota
• https://bdu.fstec.ru/vul/2025-14706 · Nota de Segurança
• https://nagios.com/changelog/nagios-xi · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2024-13999 · Nota de Segurança