CVE-2025-44824CWE-863broken-access-control

CVE-2025-44824

High · published October 8, 2025

CVSS v3.1
8.5
EPSS
3%
Percentile
86.2
In the wild
Unconfirmed
What it is

Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "message": "Could not stop elasticsearch" is in the API response. This is GL:NLS#474.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.02771 · 86.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-10-08T00:15Z
Affected products (8)
ProductVersionsFixed in
nagios/log_server< 20242024
nagios/log_serverall versions—
nagios/log_serverall versions—
nagios/log_serverall versions—
nagios/log_serverall versions—
nagios/log_serverall versions—
nagios/log_serverall versions—
nagios/log_serverall versions—
References (3)
https://github.com/skraft9/nagios-log-server-dos · [email protected]https://www.nagios.com/changelog/#log-server · [email protected]https://github.com/skraft9/nagios-log-server-dos · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 07 OCT 00:00Z
    Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a…
    cvelistv5