Cyber Posture

CVE-2024-13999

CriticalPublic PoC

Published: 30 October 2025

Published
30 October 2025
Modified
06 November 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0084 74.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in an attempt to collect credentials.

Security Summary

CVE-2024-13999 is a vulnerability affecting Nagios XI versions prior to 2024R1.1.3. Under certain circumstances, it discloses the server's Active Directory (AD) or LDAP authentication token to an authenticated user. This issue is classified under CWE-497 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

An authenticated user can exploit this vulnerability to obtain the exposed AD or LDAP token. Possession of the token could enable domain-wide authentication misuse, escalation of privileges, or further compromise of network-integrated systems.

Advisories recommend upgrading to Nagios XI 2024R1.1.3 or later to mitigate the issue, as prior versions are vulnerable. Further details are provided in the Nagios changelog at https://www.nagios.com/changelog/nagios-xi/, the Nagios security page at https://www.nagios.com/products/security/#nagios-xi, and the VulnCheck advisory at https://www.vulncheck.com/advisories/nagios-xi-ad-ldap-token-authenticated-information-disclosure.

Details

CWE(s)
CWE-497

Affected Products

nagios
nagios xi
2024 · ≤ 2024

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1212 Exploitation for Credential Access Credential Access
Adversaries may exploit software vulnerabilities in an attempt to collect credentials.
Why these techniques?

Nagios XI is a public-facing web application vulnerability (T1190) that, when exploited by an authenticated user, discloses AD/LDAP authentication tokens, directly enabling exploitation for credential access (T1212) for domain-wide misuse.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References