PT-2025-44801 · Nagios Enterprises · Nagios Xi

Published 2024-05-28 · Updated 2025-11-04 · CVE-2024-13998

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.1.3

Description Nagios XI may disclose sensitive user account information, including API keys and hashed passwords, to authenticated users who lack the necessary permissions. This exposure could lead to account compromise, misuse of API privileges, or attempts to crack passwords offline. The issue relates to unauthorized access to protected information within the IT infrastructure monitoring tool.

Recommendations Update to version 2024R1.1.3 or later.

Fix

Weakness Enumeration

CWE-497

Related Identifiers

BDU:2025-14478

CVE-2024-13998

Affected Products

Nagios Xi

References · 8

• https://nagios.com/changelog/nagios-xi · Patch
• https://osv.dev/vulnerability/CVE-2024-13998 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13998 · Security Note
• https://bdu.fstec.ru/vul/2025-14478 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-13998 · Security Note
• https://t.me/CVEtracker/36451 · Telegram Post
• https://vulncheck.com/advisories/nagios-xi-api-keys-and-hashed-password-authenticated-information-disclosure-2 · Note
• https://nagios.com/products/security/#nagios-xi · Patch, Vendor Advisory