HIGH🇵🇱 Wersja polska

CVE-2023-7322

CVSS 8.7v4.0pub. 2025-10-30upd. 2025-11-06

Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless able to invoke API endpoints, resulting in unintended access to data and actions exposed via the API. This incorrect authorization check could allow authenticated but non-privileged users to read or modify resources beyond their intended rights.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Nagios Log Server

    APP
    Nagios
    < 2024
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-34274CRITICAL9.3PL ✓ten sam produkt

Nagios Log Server: uruchamianie Logstash z uprawnieniami root (privilege escalation)

CVE-2025-34277CRITICAL9.4PL ✓ten sam produkt

RCE w Nagios Log Server — code injection przez malformed dashboard ID

CVE-2025-44823CRITICAL9.9PL ✓ten sam produkt

Nagios Log Server: ujawnienie kluczy API w postaci jawnej przez authenticated użytkownika

CVE-2025-34323HIGH8.5ten sam produkt

Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combinati...

CVE-2025-34322HIGH8.6ten sam produkt

Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the...