CVE-2023-24035

Nagios / Nagios XI PUBLISHED

Description (CNA)

An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison.

Affected (CNA)

Vendor / product	Versions
Nagios / Nagios XI	affected 0 before 5.9.3

CWE

CWE-208

References

https://www.nagios.com/downloads/nagios-xi/change-log/
https://www.nagios.com/security-disclosures/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.