PT-2025-44494 · Nagios · Nagios Log Server

Published 2023-12-05 · Updated 2025-10-31 · CVE-2023-7322

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nagios Log Server versions prior to 2024R1

Description Nagios Log Server versions prior to 2024R1 have an incorrect authorization issue. Users without the necessary API permissions could access API endpoints, leading to unauthorized data access and actions. This incorrect authorization check allowed authenticated users with insufficient privileges to read or modify resources they should not have access to. The issue involves the ability to invoke API endpoints without proper authorization.

Recommendations Update to version 2024R1 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-16438

CVE-2023-7322

Affected Products

Nagios Log Server

References · 7

• https://bdu.fstec.ru/vul/2025-16438 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-7322 · Security Note
• https://nagios.com/changelog/nagios-log-server-2024r1 · Patch
• https://osv.dev/vulnerability/CVE-2023-7322 · Vendor Advisory
• https://vulncheck.com/advisories/nagios-log-server-incorrect-authorization-granting-full-api-access · Note
• https://twitter.com/CVEnew/status/1984012721159852442 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1984147439272538468 · Twitter Post