Nagios Network Analyzer Broken Access Control Vulnerability Allowing Privilege Escalation

A broken access control vulnerability has been identified in Nagios Network Analyzer version 2024R1.0.3. This vulnerability allows low-privilege users with 'Read-Only' access to execute administrative actions, such as stopping system services and deleting critical resources. The issue stems from inadequate authorization enforcement, which enables unauthorized modifications that could disrupt system integrity and availability.

Impact

Exploitation of this vulnerability could lead to unauthorized system service interruptions or critical resource deletions, causing operational disruptions and potential reputational damage.

Remediation

Users can update to Nagios Network Analyzer version 2024R2.0.1, where this vulnerability has been fixed.