Advisories

Nagios Log Server < 2024R2.0.2 Cluster Manager Credential Requests Sent Over Plaintext

Go Back
severity
high
date
Affecting
  • Log Server < 2024R2.0.2

CWE
  • CWE-319 Cleartext Transmission of Sensitive Information
CVSS
8.7
CVSS V4 Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network path can intercept credentials in transit. Captured credentials could allow the attacker to authenticate as a cluster node or service account, enabling further unauthorized access, lateral movement, or system compromise.