PT-2025-44515 · Nagios · Nagios Log Server

Published 2025-08-05 · Updated 2025-10-31 · CVE-2025-34272

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nagios Log Server versions prior to 2024R2.0.3

Description When a user’s configured default dashboard is deleted in Nagios Log Server, the application does not consistently revert to an empty default dashboard. This can lead to an unexpected dashboard being displayed as the user’s default view. Depending on the dashboard sharing and access policies, this behavior may result in information exposure or unexpected privilege exposure.

Recommendations Update to version 2024R2.0.3 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2025-15161

CVE-2025-34272

Affected Products

Nagios Log Server

References · 8

• https://bdu.fstec.ru/vul/2025-15161 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34272 · Vendor Advisory
• https://nagios.com/changelog/#log-server · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-34272 · Security Note
• https://t.me/CVEtracker/36237 · Telegram Post
• https://vulncheck.com/advisories/nagios-log-server-non-empty-default-dashboard-fallback · Note
• https://nagios.com/products/security/#log-server-2024R2 · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/1984012717322043734 · Twitter Post