CVE-2024-13996

Katalog CVE

CVSS 9.8 · Critical EPSS 1,1%

Kerentanan Insufficient Session Expiration pada nagios xi. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed. As a result, any pre-existing sessions (including those potentially controlled by an attacker) remained valid after a credential update. This insufficient session expiration could allow continued unauthorized access to user data and actions even after a password change.

Rincian

Terbit di NVD

30 Oktober 2025

Terakhir diubah

2 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.nagios.com/products/security/#nagios-xi advisory vendor
• https://www.vulncheck.com/advisories/nagios-xi-session-not-invalidated-after-password-change advisory pihak ketiga
• https://www.nagios.com/changelog/nagios-xi/ release notes