CVE-2023-7322

Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless able to invoke API endpoints, resulting in unintended access to data and actions exposed via the API. This incorrect authorization check could allow authenticated but non-privileged users to read or modify resources beyond their intended rights.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.nagios.com/changelog/nagios-log-server-2024r1/	Release Notes
https://www.vulncheck.com/advisories/nagios-log-server-incorrect-authorization-granting-full-api-access	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nagios:log_server:*:*:*:*:*:*:*:*

History

18 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Nagios Log Server anteriores a 2024R1 contienen una vulnerabilidad de autorización incorrecta. Los usuarios que carecían del permiso de API requerido, sin embargo, pudieron invocar puntos finales de API, lo que resultó en un acceso no intencionado a datos y acciones expuestos a través de la API. Esta verificación de autorización incorrecta podría permitir a usuarios autenticados pero no privilegiados leer o modificar recursos más allá de sus derechos previstos.

Information

Published : 2025-10-30 22:15

Updated : 2026-10-18 00:10

NVD link : CVE-2023-7322

Mitre link : CVE-2023-7322

CVE.ORG link : CVE-2023-7322

JSON object : View

Products Affected

nagios

log_server

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2023-7322", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-7322", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-31T15:11:28.765501Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Nagios", "modules": ["Web API / Authorization and Permission Enforcement Layer"], "product": "Log Server", "versions": [{"status": "affected", "version": "0", "lessThan": "2024R1", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-30T22:15:44.200", "references": [{"url": "https://www.nagios.com/changelog/nagios-log-server-2024r1/", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/nagios-log-server-incorrect-authorization-granting-full-api-access", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless able to invoke API endpoints, resulting in unintended access to data and actions exposed via the API. This incorrect authorization check could allow authenticated but non-privileged users to read or modify resources beyond their intended rights."}, {"lang": "es", "value": "Las versiones de Nagios Log Server anteriores a 2024R1 contienen una vulnerabilidad de autorizaci\u00f3n incorrecta. Los usuarios que carec\u00edan del permiso de API requerido, sin embargo, pudieron invocar puntos finales de API, lo que result\u00f3 en un acceso no intencionado a datos y acciones expuestos a trav\u00e9s de la API. Esta verificaci\u00f3n de autorizaci\u00f3n incorrecta podr\u00eda permitir a usuarios autenticados pero no privilegiados leer o modificar recursos m\u00e1s all\u00e1 de sus derechos previstos."}], "lastModified": "2026-10-18T00:10:00.123", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nagios:log_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87E74637-713C-4DD7-B97E-2F247B7B12B1", "versionEndExcluding": "2024"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}