CVE-2013-10072 Details
Description
Nagios XI versions prior to 2012R1.6 contain an authorization flaw in the Auto-Discovery functionality. Users with read-only roles could directly reach Auto-Discovery endpoints and pages that should require elevated permissions, exposing discovery results and allowing unintended access to discovery operations.
A missing authorization vulnerability has been identified in the Auto-Discovery feature of Nagios XI, affecting versions prior to 2012R1.6. This vulnerability allows users with read-only roles to access Auto-Discovery endpoints and pages that require elevated permissions. As a result, these users can view discovery results and perform unintended discovery operations.
Users can upgrade to Nagios XI version 2012R1.6 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 31, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.nagios.com/changelog/nagios-xi/ | [email protected] | Release Notes |
| https://www.vulncheck.com/advisories/nagios-xi-auto-discovery-missing-authorization | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nagios nagios xi | <= 2011 2012 r1.0 2012 r1.1 2012 r1.2 2012 r1.3 2012 r1.4 2012 r1.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 16, 2026 | CVE Modified | [email protected] |
| Jun 16, 2026 | CVE Modified | CISA-ADP |
| Nov 6, 2025 | Initial Analysis | [email protected] |
| Oct 30, 2025 | New CVE Received | [email protected] |