CVE-2024-13998CWE-497

CVE-2024-13998

Medium · published November 4, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
63.7
In the wild
Unconfirmed
What it is

Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts. CVE-2024-13995 addresses a similar vulnerability with a potentially incomplete fix for the underlying problem in earlier versions.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01040 · 63.7th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2025-11-04T03:16Z
Affected products (7)
ProductVersionsFixed in
nagios/nagios_xi< 20242024
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
References (3)
https://www.nagios.com/changelog/nagios-xi/ · [email protected]https://www.nagios.com/products/security/#nagios-xi · [email protected]https://www.vulncheck.com/advisories/nagios-xi-api-keys-and-hashed-password-authenticated-information-disclosure-2 · [email protected]
EPSS history
Timeline
  • 03 NOV 21:53Z
    Nagios XI < 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information Disclosure
    cvelistv5