skraft9/nagios-log-server-dos

skraft9/nagios-log-server-dos

GitHubGitHub
GitHubgithub.com
Releases0
Incorrect Authorization (CWE-863) in Nagios Log Server 2024R1.3.1
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2025-44824↗
8.5 HIGH—

Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "message": "Could not stop elasticsearch" is in the API response. This is GL:NLS#474.