PT-2025-7442 · Nagios Xi · Nagios Xi

Published 2024-12-20 · Updated 2025-06-18 · CVE-2024-54961

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nagios XI version 2024R1.2.2

Description The issue allows unauthenticated users to access multiple pages that display the usernames and email addresses of all current users. This is an Information Disclosure vulnerability.

Recommendations For Nagios XI version 2024R1.2.2, as a temporary workaround, consider restricting access to the pages that display user information until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2025-12951

CVE-2024-54961

Affected Products

Nagios Xi

References · 12

• 🔥 https://github.com/Sharpe-nl/CVEs/tree/main/CVE-2024-54961 · Exploit
• https://osv.dev/vulnerability/CVE-2024-54961 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-54961 · Security Note
• https://bdu.fstec.ru/vul/2025-12951 · Security Note
• https://twitter.com/VulmonFeeds/status/1892748013006680243 · Twitter Post
• https://gbhackers.com/nagios-xi-flaw · Note
• https://t.me/cvedetector/18593 · Telegram Post
• https://twitter.com/CVEnew/status/1892640041823879439 · Twitter Post
• https://twitter.com/IseleyeNimi/status/1894473475588292759 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1892701390473982434 · Twitter Post
• https://t.me/cvenotify/126131 · Telegram Post
• https://twitter.com/syedaquib77/status/1892985901858623629 · Twitter Post