CVE-2023-24035
3.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Summary
An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Nagios | Nagios XI | 0 < 5.9.3 | affected |
Weaknesses
- CWE-208: CWE-208 Observable Timing Discrepancy
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.