CVE-2025-34272
Nagios Log Server < 2024R2.0.3 Non-Empty Default Dashboard Fallback
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 30, 2025
- Updated
- Nov 17, 2025
- Reserved
- Apr 15, 2025
Description
In Nagios Log Server versions prior to 2024R2.0.3, when a user's configured default dashboard is deleted, the application does not reliably fall back to an empty, default dashboard. In some implementations this can result in an unexpected dashboard being presented as the user's default view. Depending on the product's dashboard sharing and access policies, this behavior may cause information exposure or unexpected privilege exposure.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
Log ServerNagios |
|
References
- https://www.nagios.com/products/security/#log-server-2024R2vendor-advisorypatch
- https://www.nagios.com/changelog/#log-serverrelease-notespatch
- https://www.vulncheck.com/advisories/nagios-log-server-non-empty-default-dashboard-fallbackthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.