CVE-2023-24035: An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses a insecure timing comparison that leads to an attacker…

PriorityP420low3.5CVSS 3.1

AVNACHPRLUINSCCLINAN

EPSS

0.77%

53.9th percentile

An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
nagios	nagios_xi	< 5.9.3	5.9.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.