CVE-2025-34283CWE-497

CVE-2025-34283

Medium · published October 31, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
63.7
In the wild
Unconfirmed
What it is

Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01040 · 63.7th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2025-10-31T02:15Z
Affected products (20)
ProductVersionsFixed in
nagios/nagios_xi< 20242024
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
References (3)
https://www.nagios.com/changelog/nagios-xi/ · [email protected]https://www.nagios.com/products/security/#nagios-xi · [email protected]https://www.vulncheck.com/advisories/nagios-xi-api-key-disclosure-via-neptune-themes · [email protected]
EPSS history
Timeline
  • 30 OCT 21:29Z
    Nagios XI < 2024R1.4.2 API Key Disclosure via Neptune Themes
    cvelistv5