CVE-2023-48082 Weak cryptography in n/a
Attackers can predict API keys due to weak generation, allowing them to authenticate as other users and take over accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-48082?
CVE-2023-48082 is a critical vulnerability in Nagios Nagios Xi, published on 14 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nagios XI before 2024R1 was discovered to improperly handle API keys generation (randomly-generated), allowing attackers to possibly generate the same set of API keys for all users and utilize them to authenticate.
Weakness: CWE-79
Which versions are affected by CVE-2023-48082?
It affects 1 product.
Products include Nagios Nagios Xi.
How do I fix CVE-2023-48082?
No fix has been published for CVE-2023-48082 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-48082 being exploited?
There is no known exploitation of CVE-2023-48082 in the wild and no public exploit code.
Other vulnerabilities in Nagios Nagios Xi
Sources
Also known as GHSA-6p2j-228c-wmvm.