CVE-2023-24035
LowCVSS 3.5Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses an insecure timing comparison that leads to an attacker being able to bruteforce the admin password by measuring timing differences in the comparison.
Risk Assessment
Organizations using Nagios XI are exposed to brute-force attacks that can lead to admin account takeover.
Recommendation
Update Nagios XI to version 5.9.3 or later to fix the vulnerability.
Other vulnerabilities in Nagios XI
See all- CVE-2023-40931Medium
A SQL injection vulnerability in Nagios XI versions 5.11.0 through 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in a POST request to /nagiosxi/admin/banner_message-ajaxhelper.php.
- CVE-2021-25299Medium
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS) in /usr/local/nagiosxi/html/admin/sshterm.php due to improper input sanitization. A crafted URL can steal admin session cookies or be chained with other bugs for one-click RCE.
- CVE-2021-25298HighActively exploited
Nagios XI version xi-5.7.5 is affected by OS command injection due to improper sanitization of authenticated user input in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php.
- CVE-2021-25297HighActively exploited
A vulnerability in Nagios XI version xi-5.7.5 allows OS command injection. The issue exists in the switch.inc.php file due to improper sanitization of authenticated user input.
- CVE-2021-25296HighActively exploited
Nagios XI version xi-5.7.5 is affected by OS command injection in the file windowswmi.inc.php due to improper sanitization of authenticated user input. This allows execution of arbitrary commands on the server.
- CVE-2023-24034Low
An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using an open redirect vulnerability.
- CVE-2023-7314Medium
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bandwidth Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- CVE-2023-7313Medium
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bulk Modifications tool. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- CVE-2025-56432Medium
A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScript in the context of a logged-in user's session via a specially crafted URL. The issue resides in a web component responsible for rendering performance-related data.
- CVE-2024-33775High
An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted Dashlet.
Original NVD description (English source)
An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison.