Nagios Fusion Two-Factor Authentication Session Management Vulnerability

A vulnerability exists in Nagios Fusion versions prior to R2.1, where the application fails to enforce re-authentication or session rotation for users who have enabled two-factor authentication (2FA). This oversight allows an attacker with a valid session to maintain access even after the user activates 2FA, potentially leading to persistent account takeover by preventing the user from disconnecting the attacker.

Impact

Exploitation of this vulnerability could result in unauthorized continued access to a user's account after 2FA is enabled, allowing for persistent account takeover.

Remediation

Users are advised to upgrade to Nagios Fusion version R2.1 or higher.