CVE-2025-60425

Katalog CVE

CVSS 8.6 · High EPSS 0,98%

Kerentanan Public cloneable() Method Without Final ('Object Hijack') pada nagios fusion. Skor CVSS 3.1 8.6 (High) menurut CISA ADP.

Deskripsi (NVD)

Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack.

Rincian

Terbit di NVD

27 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.6 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-491: Public cloneable() Method Without Final ('Object Hijack')

EPSS (30 hari)

0,98% peluang dieksploitasi; lebih tinggi dari 61,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA mitigasi · advisory pihak ketiga
• https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA-CVE-2025-60425 mitigasi · advisory pihak ketiga
• https://www.nagios.com/changelog/#fusion release notes