CVE-2024-13995

Nagios XI < 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information Disclosure

State: Published
Severity: 7.1 High
Published: Oct 30, 2025
Updated: Nov 17, 2025
Reserved: Oct 22, 2025

Description

Nagios XI versions prior to 2024R1.1.2 may (confirmed in 2024R1.1 and 2024R1.1.1) disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

Affected Products

Product	Versions
XINagios	2024R1.1 to before 2024R1.1.2Affected 2024R1.1.1 to before 2024R1.1.2Affected before 2024R1.1.2Unknown

References

https://www.nagios.com/products/security/#nagios-xivendor-advisorypatch
https://www.nagios.com/changelog/nagios-xi/release-notespatch
https://www.vulncheck.com/advisories/nagios-xi-api-keys-and-hashed-password-authenticated-information-disclosurethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.