Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "message": "Could not stop elasticsearch" is in the API response. This is GL:NLS#474.
References
| Link | Resource |
|---|---|
| https://github.com/skraft9/nagios-log-server-dos | Exploit Third Party Advisory |
| https://www.nagios.com/changelog/#log-server | Release Notes |
| https://github.com/skraft9/nagios-log-server-dos | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
06 Nov 2025, 16:40
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Nagios log Server
Nagios |
|
| References | () https://github.com/skraft9/nagios-log-server-dos - Exploit, Third Party Advisory | |
| References | () https://www.nagios.com/changelog/#log-server - Release Notes | |
| CPE | cpe:2.3:a:nagios:log_server:2024:r1:*:*:*:*:*:* cpe:2.3:a:nagios:log_server:2024:r1.0.2:*:*:*:*:*:* cpe:2.3:a:nagios:log_server:2024:r1.1:*:*:*:*:*:* cpe:2.3:a:nagios:log_server:2024:r1.3:*:*:*:*:*:* cpe:2.3:a:nagios:log_server:*:*:*:*:*:*:*:* cpe:2.3:a:nagios:log_server:2024:r1.2:*:*:*:*:*:* cpe:2.3:a:nagios:log_server:2024:r1.3.1:*:*:*:*:*:* cpe:2.3:a:nagios:log_server:2024:r1.0.1:*:*:*:*:*:* |
08 Oct 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/skraft9/nagios-log-server-dos - |
07 Oct 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-07 20:15
Updated : 2025-11-06 16:40
NVD link : CVE-2025-44824
Mitre link : CVE-2025-44824
CVE.ORG link : CVE-2025-44824
JSON object : View
Products Affected
nagios
- log_server
CWE
CWE-863
Incorrect Authorization