PT-2025-44521

CVE-2025-34283

·

Published

2025-10-30

·

Updated

2026-09-30

Description by

CVSS 2.0
9.0
High
MetricsAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.4.2
Description Nagios XI versions prior to 2024R1.4.2 had a flaw where API keys were exposed to users lacking the necessary API access permissions when utilizing Neptune themes. An authenticated user, even without API privileges, could view the API key value belonging to another user or their own. The affected API keys were revealed through the use of Neptune themes.
Recommendations Update to version 2024R1.4.2 or later.
Exploitability
Fix
Vendors
Affected products
Weakness enumeration
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Related identifiers
CVE-2025-34283
BDU:2025-14701
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com