Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nagios Log Server < 2024R2.0.3 Logstash Process Root Privileges
Vulnerability Description
Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attacker is able to compromise the Logstash process - for example by exploiting an insecure plugin, pipeline configuration injection, or a vulnerability in input parsing - the attacker could execute code with root privileges, resulting in full system compromise. The Logstash service has been altered to run as the lower-privileged 'nagios' user to reduce this risk associated with a network-facing service that can accept untrusted input or load third-party components.
CVSS Information
N/A
Vulnerability Type
带着不必要的权限执行
Vulnerability Title
Nagios Log Server 安全漏洞
Vulnerability Description
Nagios Log Server是美国Nagios公司的一套集中式日志管理、监控和分析软件。 Nagios Log Server 2024R2.0.3之前版本存在安全漏洞，该漏洞源于嵌入式Logstash进程以root用户运行，可能导致攻击者通过不安全插件或输入解析漏洞获取root权限，造成系统完全破解。
CVSS Information
N/A
Vulnerability Type
N/A