CVE-2025-34274: log server before 2024 (exclusive), 2024 · update r1, 2024 · update r1.0.1 (+12 more affected versions); +1 more…

Affected technology

log server · before 2024 (exclusive)
nagios

log server · 2024 · update r1
nagios

log server · 2024 · update r1.0.1
nagios

log server · 2024 · update r1.0.2
nagios

log server · 2024 · update r1.1
nagios

log server · 2024 · update r1.2
nagios

log server · 2024 · update r1.3
nagios

log server · 2024 · update r1.3.1
nagios

log server · 2024 · update r1.3.2
nagios

log server · 2024 · update r1.3.3
nagios

log server · 2024 · update r1.3.4
nagios

log server · 2024 · update r1.3.5
nagios

log server · 2024 · update r2
nagios

log server · 2024 · update r2.0.1
nagios

log server · 2024 · update r2.0.2
nagios

Log Server · 0 to before 2024R2.0.3
Nagios

Description’s affected range: versions prior to 2024R2.0.3

Component: Logstash process

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source says if an attacker is able to compromise the Logstash process - for example by exploiting an insecure plugin, pipeline configuration injection, or a vulnerability in input parsing - the attacker could execute code with root privileges, resulting in full system compromise. Vendor/CNA’s CVSS 4.0 assessment (base score 9.3/10) rates confidentiality, integrity and availability impact as high.