CVE-2025-28132

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-28132
A session management flaw in Nagios Network Analyzer 2024R1.0.3 allows an attacker to reuse session tokens even after a user logs out, leading to unauthorized access and account takeover. This occurs due to insufficient session expiration, where session tokens remain valid beyond logout, allowing an attacker to impersonate users and perform actions on their behalf.

4.6 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/harshal79/Insufficient-Session-Expiration.git Third Party Advisory
https://www.nagios.com/changelog/#network-analyzer Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:nagios:nagios_network_analyzer:2024:r1.0.3*:*:*:*:*:*:*
History

18 Jun 2025, 13:59

Type Values Removed Values Added
Summary
  • (es) Una falla en la gestión de sesiones en Nagios Network Analyzer 2024R1.0.3 permite a un atacante reutilizar tokens de sesión incluso después de que un usuario cierre sesión, lo que provoca accesos no autorizados y robo de cuentas. Esto se debe a una expiración de sesión insuficiente, donde los tokens de sesión siguen siendo válidos después del cierre de sesión, lo que permite a un atacante suplantar la identidad de los usuarios y realizar acciones en su nombre.
First Time Nagios nagios Network Analyzer
Nagios
CPE cpe:2.3:a:nagios:nagios_network_analyzer:2024:r1.0.3*:*:*:*:*:*:*
References () https://github.com/harshal79/Insufficient-Session-Expiration.git - () https://github.com/harshal79/Insufficient-Session-Expiration.git - Third Party Advisory
References () https://www.nagios.com/changelog/#network-analyzer - () https://www.nagios.com/changelog/#network-analyzer - Release Notes

01 Apr 2025, 20:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.6
CWE CWE-613

01 Apr 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-01 17:15

Updated : 2025-06-18 13:59

NVD link : CVE-2025-28132

Mitre link : CVE-2025-28132

CVE.ORG link : CVE-2025-28132

JSON object : View

Products Affected

nagios

  • nagios_network_analyzer
CWE
CWE-613

Insufficient Session Expiration