Nagios XI Session Management Vulnerability After Password Change

A vulnerability exists in Nagios XI versions prior to 2024R1.1.3, where changing a user's password does not invalidate all active sessions. This flaw allows pre-existing sessions, including those potentially compromised, to remain active after a password update. Consequently, unauthorized access to user data and actions could continue even after a password change.

Impact

This vulnerability could lead to unauthorized access to user data and actions, allowing continued exploitation of the user's session after a password change.

Remediation

Users can upgrade to Nagios XI version 2024R1.1.3 or later, where this issue has been addressed.