CVE-2023-24035
Quick assessment
Affected
Nagios Nagios XI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Nagios XI 5.9.3 之前的版本中发现了一个问题。 函数使用了不安全的时序比较，攻击者可以通过测量比较过程中的时间差异，暴力破解管理员密码。
Possible ATT&CK Techniques 1 AI
T1110 · Brute Force
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-24035
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过时间差异性导致的信息暴露
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2023-24035
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-24035
请登录查看更多情报信息。
Vendor Pages for CVE-2023-24035 (1)
IV. Related Vulnerabilities
Same product: Nagios XI
-
CVE-2023-24034
Nagios XI 5.9.3前 twilio_ajax_handler 开放重定向 -
CVE-2025-34288
Nagios XI Privilege Escalation via Writable PHP Include Exec -
CVE-2025-34227
Nagios XI < 2026R1 Configuration Wizard Authenticated Comman -
CVE-2024-13986
Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload P -
CVE-2021-33179
Nagios XI 跨站脚本漏洞
Same vendor: Nagios
-
CVE-2023-24034
Nagios XI 5.9.3前 twilio_ajax_handler 开放重定向 -
CVE-2026-2041
Nagios Host zabbixagent_configwizard_func Command Injection -
CVE-2026-2043
Nagios Host esensors_websensor_configwizard_func Command Inj -
CVE-2026-2042
Nagios Host monitoringwizard Command Injection Remote Code E -
CVE-2025-34323
Nagios Log Server < 2026R1.0.1 Local Privilege Escalation vi
Same weakness: CWE-208
-
CVE-2026-87737
OCaml mirage-crypto-ec 侧信道信息泄露漏洞 -
CVE-2026-16037
Callback Authentication Bypass via Timing Attack in PayTR's -
CVE-2026-81159
Commerce CyberSource - Moderately critical - Insufficient in -
CVE-2026-84308
phpseclib — non-constant-time X25519 scalar multiplication p -
CVE-2026-82449
Cockpit CMS before 2.14.1 Account Enumeration via Auth Timin
V. Comments for CVE-2023-24035
No comments yet