Vulnerability in Nagios Xi
CVE-2024-13998
Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts. CVE-2024-13995 addresses a similar vulnerability with a potentially incomplete fix for the underlying problem in earlier versions.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.010 (60.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 60.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
Weakness classification (CWE)
References
- www.nagios.com/products/security/ (vendor-advisory, patch, Vendor Advisory)
- www.nagios.com/changelog/nagios-xi/ (release-notes, Release Notes, patch)
- www.vulncheck.com/advisories/nagios-xi-api-keys-and-hashed-password-authenticat… (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2024-13998?
- CVE-2024-13998 is a medium-severity vulnerability in Nagios Xi, classified under Exposure of Sensitive System Information to an Unauthorized Control Sphere. CVSS score: 6.5/10. Published 2025-11-03.
- How severe is CVE-2024-13998?
- Medium severity. CVSS v3 base score is 6.5 out of 10.