CVE-2025-34271

{"id": "CVE-2025-34271", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34271", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-31T15:14:19.413150Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Nagios", "modules": ["Cluster manager credential request/replication API"], "product": "Log Server", "versions": [{"status": "affected", "version": "0", "lessThan": "2024R2.0.2", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-30T22:15:47.673", "references": [{"url": "https://www.nagios.com/changelog/#log-server", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.nagios.com/products/security/#log-server-2024R2", "tags": ["Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/nagios-log-server-cluster-manager-credential-requests-sent-over-plaintext", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "Nagios Log Server versions prior to\u00a02024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network path can intercept credentials in transit. Captured credentials could allow the attacker to authenticate as a cluster node or service account, enabling further unauthorized access, lateral movement, or system compromise."}, {"lang": "es", "value": "Las versiones de Nagios Log Server anteriores a 2024R2.0.2 contienen una vulnerabilidad en el componente de gesti\u00f3n de cl\u00fasteres al solicitar credenciales sensibles de nodos pares a trav\u00e9s de un canal no cifrado, incluso cuando SSL/TLS est\u00e1 habilitado en la configuraci\u00f3n del producto. Como resultado, un atacante posicionado en la ruta de red puede interceptar credenciales en tr\u00e1nsito. Las credenciales capturadas podr\u00edan permitir al atacante autenticarse como un nodo de cl\u00faster o una cuenta de servicio, lo que permite un acceso no autorizado adicional, movimiento lateral o compromiso del sistema."}], "lastModified": "2026-10-07T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nagios:log_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87E74637-713C-4DD7-B97E-2F247B7B12B1", "versionEndExcluding": "2024"}, {"criteria": "cpe:2.3:a:nagios:log_server:2024:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B93D415C-B2C0-42CE-B9B3-29C29A3DCC16"}, {"criteria": "cpe:2.3:a:nagios:log_server:2024:r1.0.1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "997B64B5-A3F2-4D0E-B05E-CCA76D598C18"}, {"criteria": "cpe:2.3:a:nagios:log_server:2024:r1.0.2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D20F6746-83DD-49AE-8C3D-AF2FFB47A89E"}, {"criteria": "cpe:2.3:a:nagios:log_server:2024:r1.1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5EF32AF5-19EA-495A-AB28-F78F33DDEC3F"}, {"criteria": "cpe:2.3:a:nagios:log_server:2024:r1.2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C26DE7A-37AA-4570-81C1-2E0C1A9026F7"}, {"criteria": "cpe:2.3:a:nagios:log_server:2024:r1.3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "52C22468-A773-49C8-81AD-9B76C26BFFD1"}, {"criteria": "cpe:2.3:a:nagios:log_server:2024:r1.3.1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CEC223A-A3EE-4C51-8B71-E19C73B9215C"}, {"criteria": "cpe:2.3:a:nagios:log_server:2024:r1.3.2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB7A3A2A-DF36-4495-A5FE-826085120997"}, {"criteria": "cpe:2.3:a:nagios:log_server:2024:r1.3.3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AC10FEF-5606-4949-9E5E-E44FE1CE418D"}, {"criteria": "cpe:2.3:a:nagios:log_server:2024:r1.3.4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC2BBD0F-12FE-4A8F-894E-ABAEEE081E10"}, {"criteria": "cpe:2.3:a:nagios:log_server:2024:r1.3.5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16861134-A375-4918-8171-77C14A3351EB"}, {"criteria": "cpe:2.3:a:nagios:log_server:2024:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6AAEC3D7-AD80-4647-9130-F42CE4785906"}, {"criteria": "cpe:2.3:a:nagios:log_server:2024:r2.0.1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB3DFA03-0D49-4E43-9041-D7C30615B3D5"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}