CVE-2025-34298
🟡 Monitoruj
W Nagios Log Server występuje luka eskalacji uprawnień w procesie zmiany adresu e-mail.
CVSS
8.8
EPSS
0.7%
Exploit
none
Vendor
nagios
Opis źródłowy (NVD)
Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own email to an invalid value and, due to insufficient validation and authorization checks tied to email identity state, trigger inconsistent account state that granted elevated privileges or bypassed intended access controls.
privilege-escalation
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 8.8 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.7% |
| Opublikowano (NVD) | 2025-10-30 22:15:49 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-07 21:10:00 UTC |
Referencje
- https://www.nagios.com/changelog/nagios-log-server-2024r1/ ([email protected]) [Release Notes]
- https://www.vulncheck.com/advisories/nagios-log-server-set-email-privilege-escalation ([email protected]) [Third Party Advisory]