Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the test_server command in ajaxhelper.php.
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Fusion | Nagios | * | 4.1.8 (including) |