PT-2025-44513 · Nagios · Nagios Log Server

Published 2025-07-22 · Updated 2025-10-31 · CVE-2025-34270

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Nagios Log Server versions prior to 2024R2.0.2

Description The software contains a flaw in the AD/LDAP user import functionality where the password field is not properly masked during import. This can lead to the exposure of plaintext passwords in the user interface, logs, or diagnostic output, potentially compromising sensitive credentials to administrators or those with access to import results.

Recommendations Update to version 2024R2.0.2 or later.

Fix

Insufficiently Protected Credentials

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-522

CWE-312

Related Identifiers

BDU:2025-15423

CVE-2025-34270

Affected Products

Nagios Log Server

References · 10

• https://bdu.fstec.ru/vul/2025-15423 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-34270 · Security Note
• https://nagios.com/changelog/#log-server · Patch
• https://osv.dev/vulnerability/CVE-2025-34270 · Vendor Advisory
• https://vulncheck.com/advisories/nagios-log-server-ad-ldap-import-password-not-obfuscated · Note
• https://support.nagios.com/kb/article/authenticating-and-importing-users-with-ad-and-ldap-995.html · Note
• https://t.me/CVEtracker/36235 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1984096245011394852 · Twitter Post
• https://nagios.com/products/security/#log-server-2024R2 · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/1984012724100006354 · Twitter Post