CVE-2024-13995 HIGH

CVE-2024-13995: Nagios XI < 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information Disclosure

Vendor Nagios
Product XI
Weakness CWE-497
Published October 30, 2025
Last update November 17, 2025
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Nagios XI versions prior to 2024R1.1.2 may (confirmed in 2024R1.1 and 2024R1.1.1) disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts.

Key dates

02Disclosure timeline

October 30, 2025 CVE published
November 17, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-64270 WordPress Masteriyo - LMS plugin <= 2.0.3 - Sensitive Data Exposure vulnerability CVE-2025-4364 Exposure of Sensitive System Information to an Unauthorized Control Sphere CVE-2025-60119 WordPress CoSchedule Plugin <= 3.3.11 - Sensitive Data Exposure Vulnerability CVE-2025-64228 WordPress SUMO Affiliates Pro plugin <= 11.0.0 - Sensitive Data Exposure vulnerability CVE-2025-62902 WordPress WP Popup Builder plugin <= 1.3.8 - Sensitive Data Exposure vulnerability