UpHeron
All vulnerabilities

Servers and applications

CVE-2024-13995

Nagios XI versions prior to 2024R1.1.2 may (confirmed in 2024R1.1 and 2024R1.1.1) disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts.

Severity
High 7.1
Published
30 Oct 2025
Last changed
2 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
2024
Sources
NVD

Affected software

SoftwareAffected versions
Nagios XIServers and applications · cpe:a:nagios:nagios_xi
  • Every version before 2024
  • Version 2024-r1
  • Version 2024-r1.0.1
  • Version 2024-r1.0.2
  • Version 2024-r1.1
  • Version 2024-r1.1.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-13995
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-13995