{"id":"CVE-2025-34283","aliases":["EUVD-2025-37214","GHSA-7449-5996-fmvf"],"status":"published","title":"Nagios XI \u003c 2024R1.4.2 API Key Disclosure via Neptune Themes","description":"Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0104,"percentile":0.64434,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-497"],"published":"2025-10-30T21:29:37Z","modified":"2026-10-07T21:10:00Z","products":[{"vendor":"nagios","product":"nagios_xi"},{"vendor":"nagios","product":"xi"}],"references":[{"url":"https://www.nagios.com/products/security/#nagios-xi","tags":["vendor-advisory","patch","Vendor Advisory"]},{"url":"https://www.nagios.com/changelog/nagios-xi/","tags":["release-notes","patch","Release Notes"]},{"url":"https://www.vulncheck.com/advisories/nagios-xi-api-key-disclosure-via-neptune-themes","tags":["third-party-advisory","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-34283"},{"url":"https://www.nagios.com/changelog/nagios-xi"},{"url":"https://github.com/advisories/GHSA-7449-5996-fmvf"}],"sources":{"cve":[{"id":"CVE-2025-34283","title":"Nagios XI \u003c 2024R1.4.2 API Key Disclosure via Neptune Themes","description":"Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value.","status":"published","published":"2025-10-30T21:29:37.293Z","modified":"2026-09-30T17:20:04.34Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T14:32:54.1527Z"}],"euvd":[{"id":"EUVD-2025-37214","description":"Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value.","status":"published","published":"2025-10-30T21:29:37Z","modified":"2026-09-30T17:20:04Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:48.075372Z"}],"ghsa":[{"id":"GHSA-7449-5996-fmvf","title":"Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API...","description":"Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value.","status":"published","published":"2025-10-31T00:30:34Z","modified":"2025-11-06T18:32:49Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T15:04:41.281435Z"}],"nvd":[{"id":"CVE-2025-34283","description":"Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value.","status":"published","published":"2025-10-30T22:15:48.633Z","modified":"2026-10-07T21:10:00.2Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T14:11:41.607433Z"}]}}