CVE-2025-34270mediumCWE-312CWE-522

CVE-2025-34270: falha de média gravidade em Nagios Log Server

Nagios Log Server < 2024R2.0.2 AD/LDAP Import Password Not Obfuscated

Publicada em · Atualizada em

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.6%
probabilidade de exploração
0.6%top 52% das CVEs
exploração observada
nãonenhuma fonte reporta
Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field during import. As a result, the plaintext password supplied for imported accounts may be exposed in the user interface, logs, or other diagnostic output. This can leak sensitive credentials to administrators or anyone with access to import results.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Nagios · Log Server
CVEs relacionadas — Nagios Log Server

No mesmo produto, das mais perigosas para as menos.

CVE-2025-44823CRITICALCVE-2025-44823EPSS 16.1%CVE-2025-34322HIGHNagios Log Server < 2026R1.0.1 Authenticated Command Injection via Natural Language QueriesEPSS 9.5%CVE-2025-44824HIGHCVE-2025-44824EPSS 2.8%CVE-2025-34277CRITICALNagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard IDEPSS 2.2%CVE-2025-34274CRITICALNagios Log Server < 2024R2.0.3 Logstash Process Root PrivilegesEPSS 2.1%CVE-2023-7322HIGHNagios Log Server < 2024R1 Incorrect Authorization Granting Full API AccessEPSS 1.1%
Referências
https://support.nagios.com/kb/article/authenticating-and-importing-users-with-ad-and-ldap-995.htmlhttps://www.nagios.com/changelog/#log-serverhttps://www.nagios.com/products/security/#log-server-2024R2https://www.vulncheck.com/advisories/nagios-log-server-ad-ldap-import-password-not-obfuscated