An access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improper session invalidation and stale token handling. When an administrator deletes a user account, the backend fails to terminate active sessions and revoke associated API tokens, enabling unauthorized access to restricted functions.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/aakashtyal/Residual-Data-Access-Post-User-Deletion-in-Nagios-Network-Analyzer-Version-2024R1 | Third Party Advisory |
| https://www.nagios.com/changelog/#network-analyze | Release Notes |
Configurations
History
11 Jul 2025, 13:33
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:nagios:network_analyzer:2024:r1.0.3:*:*:*:*:*:* | |
| First Time |
Nagios
Nagios network Analyzer |
|
| References | () https://www.nagios.com/changelog/#network-analyze - Release Notes | |
| References | () https://github.com/aakashtyal/Residual-Data-Access-Post-User-Deletion-in-Nagios-Network-Analyzer-Version-2024R1 - Third Party Advisory |
18 Apr 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-04-18 17:15
Updated : 2025-07-11 13:33
NVD link : CVE-2025-28059
Mitre link : CVE-2025-28059
JSON object : View
Products Affected
nagios
- network_analyzer
CWE
No CWE.