| Package | Affected versions | Patched versions |
|---|---|---|
| log server | = 2024< 2024 | 2024 |
Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network path can intercept credentials in transit. Captured credentials could allow the attacker to authenticate as a cluster node or service account, enabling further unauthorized access, lateral movement, or system compromise.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free