Nagios XI Missing Authorization Control Vulnerability Allowing Insecure Logins

A vulnerability exists in Nagios XI versions prior to 2024R1.1.2, where the 'Allow Insecure Logins' option can be enabled without proper authorization controls. This flaw allows users to create valid login credentials for other users, potentially leading to unauthorized account creation, privilege escalation, or a complete compromise of the Nagios XI web interface, depending on the account in question.

Impact

Exploitation of this vulnerability could result in unauthorized account creation, privilege escalation, or full compromise of the Nagios XI web interface, depending on the target account.

Remediation

Users can upgrade to Nagios XI version 2024R1.1.2 or later to address this vulnerability.