CVE-2024-13998 MEDIUM

CVE-2024-13998: Nagios XI < 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information Disclosure

Weakness CWE-497
Published November 3, 2025
Last update November 17, 2025
View on NVD All CVEs

CVSS base score

6.0/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts. CVE-2024-13995 addresses a similar vulnerability with a potentially incomplete fix for the underlying problem in earlier versions.

Key dates

02Disclosure timeline

November 3, 2025 CVE published
November 17, 2025 Record updated