{"id":"CVE-2023-7322","state":"PUBLISHED","title":"Nagios Log Server < 2024R1 Incorrect Authorization Granting Full API Access","description":"Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless able to invoke API endpoints, resulting in unintended access to data and actions exposed via the API. This incorrect authorization check could allow authenticated but non-privileged users to read or modify resources beyond their intended rights.","publishedAt":"2025-10-30T21:23:34.547Z","updatedAt":"2025-11-17T21:36:23.640Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Nagios Log Server"],"affected":[{"vendor":"Nagios","product":"Log Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2024R1","versionType":"custom"}],"modules":["Web API / Authorization and Permission Enforcement Layer"]}],"references":["https://www.nagios.com/changelog/nagios-log-server-2024r1/","https://www.vulncheck.com/advisories/nagios-log-server-incorrect-authorization-granting-full-api-access"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/7xxx/CVE-2023-7322.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-7322","state":"PUBLISHED","datePublished":"2025-10-30T21:23:34.547Z","dateUpdated":"2025-11-17T21:36:23.640Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-10-28T19:13:16.831Z"},"containers":{"cna":{"title":"Nagios Log Server < 2024R1 Incorrect Authorization Granting Full API Access","descriptions":[{"lang":"en","value":"Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless able to invoke API endpoints, resulting in unintended access to data and actions exposed via the API. This incorrect authorization check could allow authenticated but non-privileged users to read or modify resources beyond their intended rights."}],"affected":[{"vendor":"Nagios","product":"Log Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2024R1","versionType":"custom"}],"modules":["Web API / Authorization and Permission Enforcement Layer"]}],"references":[{"url":"https://www.nagios.com/changelog/nagios-log-server-2024r1/","tags":["release-notes","patch"]},{"url":"https://www.vulncheck.com/advisories/nagios-log-server-incorrect-authorization-granting-full-api-access","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2025-11-17T21:36:23.640Z"},"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nagios:log_server:2024:*:*:*:*:*:*:*","versionEndExcluding":"r1"}]}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Nagios addresses this vulnerability as \"Fixed a security bug where users without API permissions had full API access.\"<br>"}],"value":"Nagios addresses this vulnerability as \"Fixed a security bug where users without API permissions had full API access.\""}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-31T15:11:28.765501Z","id":"CVE-2023-7322","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-31T15:11:35.246Z"}}]}}}