status.cgi in Nagios 4.0 before 4.0 beta4 and 3.x before 3.5.1 does not properly restrict access to certain users that are a contact for a service, which allows remote authenticated users to obtain sensitive information about hostnames via the servicegroup (1) overview, (2) summary, or (3) grid style in status.cgi. NOTE: this behavior is by design in most 3.x versions, but the upstream vendor decided to change it for Nagios 4 and 3.5.1.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Nagios | Nagios | 3.0 (including) | 3.0 (including) |
| Nagios | Nagios | 3.0-alpha1 (including) | 3.0-alpha1 (including) |
| Nagios | Nagios | 3.0-alpha2 (including) | 3.0-alpha2 (including) |
| Nagios | Nagios | 3.0-alpha3 (including) | 3.0-alpha3 (including) |
| Nagios | Nagios | 3.0-alpha4 (including) | 3.0-alpha4 (including) |
| Nagios | Nagios | 3.0-alpha5 (including) | 3.0-alpha5 (including) |
| Nagios | Nagios | 3.0-beta1 (including) | 3.0-beta1 (including) |
| Nagios | Nagios | 3.0-beta2 (including) | 3.0-beta2 (including) |
| Nagios | Nagios | 3.0-beta3 (including) | 3.0-beta3 (including) |
| Nagios | Nagios | 3.0-beta4 (including) | 3.0-beta4 (including) |
| Nagios | Nagios | 3.0-beta5 (including) | 3.0-beta5 (including) |
| Nagios | Nagios | 3.0-beta6 (including) | 3.0-beta6 (including) |
| Nagios | Nagios | 3.0-beta7 (including) | 3.0-beta7 (including) |
| Nagios | Nagios | 3.0-rc1 (including) | 3.0-rc1 (including) |
| Nagios | Nagios | 3.0-rc2 (including) | 3.0-rc2 (including) |
| Nagios | Nagios | 3.0-rc3 (including) | 3.0-rc3 (including) |
| Nagios | Nagios | 3.0.1 (including) | 3.0.1 (including) |
| Nagios | Nagios | 3.0.2 (including) | 3.0.2 (including) |
| Nagios | Nagios | 3.0.3 (including) | 3.0.3 (including) |
| Nagios | Nagios | 3.0.4 (including) | 3.0.4 (including) |
| Nagios | Nagios | 3.0.5 (including) | 3.0.5 (including) |
| Nagios | Nagios | 3.0.6 (including) | 3.0.6 (including) |
| Nagios | Nagios | 3.1.0 (including) | 3.1.0 (including) |
| Nagios | Nagios | 3.1.1 (including) | 3.1.1 (including) |
| Nagios | Nagios | 3.1.2 (including) | 3.1.2 (including) |
| Nagios | Nagios | 3.2.0 (including) | 3.2.0 (including) |
| Nagios | Nagios | 3.2.1 (including) | 3.2.1 (including) |
| Nagios | Nagios | 3.2.2 (including) | 3.2.2 (including) |
| Nagios | Nagios | 3.2.3 (including) | 3.2.3 (including) |
| Nagios | Nagios | 3.3.1 (including) | 3.3.1 (including) |
| Nagios | Nagios | 3.4.0 (including) | 3.4.0 (including) |
| Nagios | Nagios | 3.4.1 (including) | 3.4.1 (including) |
| Nagios | Nagios | 3.4.2 (including) | 3.4.2 (including) |
| Nagios | Nagios | 3.4.3 (including) | 3.4.3 (including) |
| Nagios | Nagios | 3.4.4 (including) | 3.4.4 (including) |
| Nagios | Nagios | 3.5.0 (including) | 3.5.0 (including) |
| Nagios | Nagios | 4.0.0-beta1 (including) | 4.0.0-beta1 (including) |
| Nagios | Nagios | 4.0.0-beta2 (including) | 4.0.0-beta2 (including) |
| Nagios | Nagios | 4.0.0-beta3 (including) | 4.0.0-beta3 (including) |