CVE-2025-34298
Nagios Log Server < 2024R1.3.2 Set Email Privilege Escalation
- State
- Published
- Severity
- 8.7 High
- Published
- Oct 30, 2025
- Updated
- Nov 17, 2025
- Reserved
- Apr 15, 2025
Description
Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own email to an invalid value and, due to insufficient validation and authorization checks tied to email identity state, trigger inconsistent account state that granted elevated privileges or bypassed intended access controls.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-281 Improper Preservation of Permissions
Affected Products
| Product | Versions |
|---|---|
Log ServerNagios |
|
References
- https://www.nagios.com/changelog/nagios-log-server-2024r1/release-notespatch
- https://www.vulncheck.com/advisories/nagios-log-server-set-email-privilege-escalationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.