CVE-2025-34270CWE-312CWE-522

CVE-2025-34270

Medium · published October 31, 2025

CVSS v3.1
4.9
EPSS
1%
Percentile
49.4
In the wild
Unconfirmed
What it is

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field during import. As a result, the plaintext password supplied for imported accounts may be exposed in the user interface, logs, or other diagnostic output. This can leak sensitive credentials to administrators or anyone with access to import results.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00626 · 49.4th percentile
Weaknesses
CWE-312 · Cleartext Storage of Sensitive Information; CWE-522 · Insufficiently Protected Credentials
Published
2025-10-31T02:15Z
Affected products (14)
ProductVersionsFixed in
nagios/log_server< 20242024
nagios/log_serverall versions—
nagios/log_serverall versions—
nagios/log_serverall versions—
nagios/log_serverall versions—
nagios/log_serverall versions—
nagios/log_serverall versions—
nagios/log_serverall versions—
nagios/log_serverall versions—
nagios/log_serverall versions—
nagios/log_serverall versions—
nagios/log_serverall versions—
nagios/log_serverall versions—
nagios/log_serverall versions—
References (4)
https://support.nagios.com/kb/article/authenticating-and-importing-users-with-ad-and-ldap-995.html · [email protected]https://www.nagios.com/changelog/#log-server · [email protected]https://www.nagios.com/products/security/#log-server-2024R2 · [email protected]https://www.vulncheck.com/advisories/nagios-log-server-ad-ldap-import-password-not-obfuscated · [email protected]
EPSS history
Timeline
  • 30 OCT 21:22Z
    Nagios Log Server < 2024R2.0.2 AD/LDAP Import Password Not Obfuscated
    cvelistv5