CVEvulnerability

CVE-2025-34283

7.1 HIGH Published 2025-10-30 Modified 2026-10-07 Official page ↗
Status
Analyzed
Published
2025-10-30
Last modified
2026-10-07
Assigner
[email protected]
CVSS 4.0 ([email protected])
7.1 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-497

Description

Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value.

Affected configurations

• nagios nagios xi (< 2024) • nagios nagios xi 2024

Related

Weakness · CWE (1)

  • CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere weakness

References