CVE-2024-13998
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts. CVE-2024-13995 addresses a similar vulnerability.
Risk Assessment
An authenticated low-privileged user can obtain API keys and password hashes of other accounts, potentially leading to privilege escalation and account takeover. The risk is high in multi-user environments.
Recommendation
Update Nagios XI to version 2024R1.1.3 or later. After updating, consider rotating API keys and forcing password changes for potentially exposed accounts.
Other vulnerabilities in Nagios XI
See all- CVE-2025-34284High
Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user.
- CVE-2024-14005High
Nagios XI versions prior to 2024R1.2 contain a command injection vulnerability in the Docker Wizard. Insufficient validation of user-supplied input in the wizard allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user.
- CVE-2024-14003Critical
Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP server plugins. Insufficient validation of inbound NRDP request parameters allows crafted input to reach command execution paths, enabling attackers to execute arbitrary commands on the underlying host in the context of the web/Nagios service.
- CVE-2024-13999Critical
Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory (AD) or LDAP authentication token to an authenticated user. Exposure of the server’s AD/LDAP token could allow domain-wide authentication misuse, escalation of privileges, or further compromise of network-integrated systems.
- CVE-2024-13996Critical
Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed. As a result, any pre-existing sessions (including those potentially controlled by an attacker) remained valid after a credential update. This insufficient session expiration could allow continued unauthorized access to user data and actions even after a password change.
- CVE-2024-13994Critical
Nagios XI versions prior to 2024R1.1.2 have a missing authorization control when the 'Allow Insecure Logins' option is enabled. Under this configuration, any user can create valid login credentials for other users without proper authorization.
- CVE-2023-40931Medium
A SQL injection vulnerability in Nagios XI versions 5.11.0 through 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in a POST request to /nagiosxi/admin/banner_message-ajaxhelper.php.
- CVE-2021-25299Medium
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS) in /usr/local/nagiosxi/html/admin/sshterm.php due to improper input sanitization. A crafted URL can steal admin session cookies or be chained with other bugs for one-click RCE.
- CVE-2021-25298HighActively exploited
Nagios XI version xi-5.7.5 is affected by OS command injection due to improper sanitization of authenticated user input in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php.
- CVE-2021-25297HighActively exploited
A vulnerability in Nagios XI version xi-5.7.5 allows OS command injection. The issue exists in the switch.inc.php file due to improper sanitization of authenticated user input.
Original NVD description (English source)
Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts. CVE-2024-13995 addresses a similar vulnerability with a potentially incomplete fix for the underlying problem in earlier versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS