CVE-2025-34272 MEDIUM

CVE-2025-34272: Nagios Log Server < 2024R2.0.3 Non-Empty Default Dashboard Fallback

Vendor Nagios
Product Log Server
Weakness CWE-200 · Info exposure
Published October 30, 2025
Last update November 17, 2025

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

In Nagios Log Server versions prior to 2024R2.0.3, when a user's configured default dashboard is deleted, the application does not reliably fall back to an empty, default dashboard. In some implementations this can result in an unexpected dashboard being presented as the user's default view. Depending on the product's dashboard sharing and access policies, this behavior may cause information exposure or unexpected privilege exposure.

Key dates

02Disclosure timeline

October 30, 2025 CVE published
November 17, 2025 Record updated