CVE-2025-28059: nagios network_analyzer Insufficient Session Expiration

Vulnerability summary

CVE-2025-28059 is a high (CVSS 7.5) Insufficient Session Expiration vulnerability in nagios network_analyzer. EPSS estimates a 0.83% chance of exploitation in the next 30 days, higher than 57.1% of scored vulnerabilities.

Timeline

1. 18-04-2025
   PublishedVulnerability first disclosed.
2. 22-04-2025
   Last modifiedVulnerability information updated.

Description

An access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improper session invalidation and stale token handling. When an administrator deletes a user account, the backend fails to terminate active sessions and revoke associated API tokens, enabling unauthorized access to restricted functions.

• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."