HIGH🇬🇧 English

CVE-2023-7322

CVSS 8.7v4.0pub. 2025-10-30upd. 2025-11-06

Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless able to invoke API endpoints, resulting in unintended access to data and actions exposed via the API. This incorrect authorization check could allow authenticated but non-privileged users to read or modify resources beyond their intended rights.

oryginał EN
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Nagios Log Server

    APP
    Nagios
    < 2024
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2025-34274CRITICAL9.3PL ✓ten sam produkt

Nagios Log Server: uruchamianie Logstash z uprawnieniami root (privilege escalation)

CVE-2025-34277CRITICAL9.4PL ✓ten sam produkt

RCE w Nagios Log Server — code injection przez malformed dashboard ID

CVE-2025-44823CRITICAL9.9PL ✓ten sam produkt

Nagios Log Server: ujawnienie kluczy API w postaci jawnej przez authenticated użytkownika

CVE-2025-34323HIGH8.5ten sam produkt

Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combinati...

CVE-2025-34322HIGH8.6ten sam produkt

Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the...