Nagios Log Server AD/LDAP Import Password Exposure Vulnerability

A vulnerability exists in Nagios Log Server versions prior to 2024R2.0.2 within the Active Directory (AD) and Lightweight Directory Access Protocol (LDAP) user import feature. The vulnerability arises because the password field is not properly obfuscated during the import process. Consequently, plaintext passwords for imported accounts may be visible in the user interface, logs, or other diagnostic outputs, potentially leaking sensitive credentials to administrators or anyone with access to the import results.

Impact

This vulnerability allows for the exposure of plaintext passwords in the user interface, logs, or other diagnostic outputs, creating a risk of leaking sensitive credentials.

Remediation

Users can upgrade to Nagios Log Server version 2024R2.0.2 or later to address this vulnerability.