Log Server
by Nagios
CVEs (26)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-44823 | Cri | 0.66 | 9.9 | 0.16 | Oct 7, 2025 | Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call. This is GL:NLS#475. | ||
| CVE-2025-34277 | Cri | 0.64 | 9.8 | 0.02 | Oct 30, 2025 | Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID values are not properly validated before being forwarded to an internal API. An attacker able to supply crafted dashboard ID values can cause the system to… | ||
| CVE-2025-34274 | Cri | 0.64 | 9.8 | 0.02 | Oct 30, 2025 | Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attacker is able to compromise the Logstash process - for example by exploiting an insecure plugin,… | ||
| CVE-2025-34271 | Cri | 0.64 | 9.8 | 0.01 | Oct 30, 2025 | Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker… | ||
| CVE-2025-34298 | Hig | 0.57 | 8.8 | 0.01 | Oct 30, 2025 | Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own email to an invalid value and, due to insufficient validation and authorization checks tied to email identity state,… | ||
| CVE-2025-29471 | Hig | 0.57 | 8.3 | 0.07 | Apr 15, 2025 | Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field. | ||
| CVE-2020-6585 | Hig | 0.57 | 8.8 | 0.01 | Mar 16, 2020 | Nagios Log Server 2.1.3 has CSRF. | ||
| CVE-2025-44824 | Hig | 0.55 | 8.5 | 0.03 | Oct 7, 2025 | Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "message": "Could not stop elasticsearch" is… | ||
| CVE-2023-7322 | Hig | 0.53 | 8.1 | 0.01 | Oct 30, 2025 | Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless able to invoke API endpoints, resulting in unintended access to data and actions exposed via the API. This incorrect… | ||
| CVE-2025-34323 | Hig | 0.51 | 7.8 | 0.00 | Nov 17, 2025 | Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combination of sudo misconfiguration and group-writable application directories. The 'www-data' user is a member of the 'nagios' group, which has write access to… | ||
| CVE-2024-58273 | Hig | 0.51 | 7.8 | 0.00 | Oct 30, 2025 | Nagios Log Server versions prior to 2024R1.0.2 contain a local privilege escalation vulnerability that allows an attacker who could execute commands as the Apache web user (or the backend shell user) to escalate to root on the host. | ||
| CVE-2025-34322 | Hig | 0.47 | 7.2 | 0.09 | Nov 17, 2025 | Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental 'Natural Language Queries' feature. When this feature is configured, certain user-controlled settings—including model selection and connection… | ||
| CVE-2020-6584 | Med | 0.43 | 6.5 | 0.04 | Mar 16, 2020 | Nagios Log Server 2.1.3 has Incorrect Access Control. | ||
| CVE-2025-34273 | Med | 0.42 | 6.5 | 0.01 | Oct 30, 2025 | Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards. The application did not correctly enforce authorization checks for the global dashboard deletion workflow, enabling… | ||
| CVE-2025-34272 | Med | 0.42 | 6.5 | 0.01 | Oct 30, 2025 | In Nagios Log Server versions prior to 2024R2.0.3, when a user's configured default dashboard is deleted, the application does not reliably fall back to an empty, default dashboard. In some implementations this can result in an unexpected dashboard being presented as the user's… | ||
| CVE-2021-35478 | Med | 0.41 | 5.4 | 0.77 | Jul 30, 2021 | Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affects users who open a crafted link or third-party web page. | ||
| CVE-2020-25385 | Med | 0.41 | 6.1 | 0.16 | Jan 20, 2021 | Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapshot_name parameter, which may impact users who open a maliciously crafted link or third-party web page. | ||
| CVE-2019-15898 | Med | 0.40 | 6.1 | 0.02 | Sep 3, 2019 | Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page. | ||
| CVE-2020-6586 | Med | 0.37 | 5.4 | 0.19 | Mar 16, 2020 | Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered. | ||
| CVE-2021-35479 | Med | 0.36 | 5.4 | 0.13 | Jul 30, 2021 | Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter. This affects users who open a crafted link or third-party web page. |
- risk 0.66cvss 9.9epss 0.16
Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call. This is GL:NLS#475.
- risk 0.64cvss 9.8epss 0.02
Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID values are not properly validated before being forwarded to an internal API. An attacker able to supply crafted dashboard ID values can cause the system to…
- risk 0.64cvss 9.8epss 0.02
Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attacker is able to compromise the Logstash process - for example by exploiting an insecure plugin,…
- risk 0.64cvss 9.8epss 0.01
Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker…
- risk 0.57cvss 8.8epss 0.01
Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own email to an invalid value and, due to insufficient validation and authorization checks tied to email identity state,…
- risk 0.57cvss 8.3epss 0.07
Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field.
- risk 0.57cvss 8.8epss 0.01
Nagios Log Server 2.1.3 has CSRF.
- risk 0.55cvss 8.5epss 0.03
Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "message": "Could not stop elasticsearch" is…
- risk 0.53cvss 8.1epss 0.01
Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless able to invoke API endpoints, resulting in unintended access to data and actions exposed via the API. This incorrect…
- risk 0.51cvss 7.8epss 0.00
Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combination of sudo misconfiguration and group-writable application directories. The 'www-data' user is a member of the 'nagios' group, which has write access to…
- risk 0.51cvss 7.8epss 0.00
Nagios Log Server versions prior to 2024R1.0.2 contain a local privilege escalation vulnerability that allows an attacker who could execute commands as the Apache web user (or the backend shell user) to escalate to root on the host.
- risk 0.47cvss 7.2epss 0.09
Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental 'Natural Language Queries' feature. When this feature is configured, certain user-controlled settings—including model selection and connection…
- risk 0.43cvss 6.5epss 0.04
Nagios Log Server 2.1.3 has Incorrect Access Control.
- risk 0.42cvss 6.5epss 0.01
Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards. The application did not correctly enforce authorization checks for the global dashboard deletion workflow, enabling…
- risk 0.42cvss 6.5epss 0.01
In Nagios Log Server versions prior to 2024R2.0.3, when a user's configured default dashboard is deleted, the application does not reliably fall back to an empty, default dashboard. In some implementations this can result in an unexpected dashboard being presented as the user's…
- risk 0.41cvss 5.4epss 0.77
Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affects users who open a crafted link or third-party web page.
- risk 0.41cvss 6.1epss 0.16
Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapshot_name parameter, which may impact users who open a maliciously crafted link or third-party web page.
- risk 0.40cvss 6.1epss 0.02
Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page.
- risk 0.37cvss 5.4epss 0.19
Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered.
- risk 0.36cvss 5.4epss 0.13
Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter. This affects users who open a crafted link or third-party web page.
Page 1 of 2