CVE-2020-6584: 
Nagios vulnerability analysis and mitigation

CVE-2020-6584 affects Nagios Log Server version 2.1.3, identified as an Incorrect Access Control vulnerability. The vulnerability was discovered and disclosed on March 16, 2020. This security issue impacts the authentication mechanism of Nagios Log Server, allowing potential session token theft (Medium Blog).

The vulnerability allows an attacker to steal csrf_ls and PHPSESSID tokens of an administrator account through a privilege escalation vulnerability. Specifically, users with limited access can store queries accessible to all users, which can be leveraged to escalate privileges. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (MEDIUM) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability enables attackers to perform unauthorized administrative actions by stealing and reusing valid session tokens. This could lead to complete compromise of the logging system's configuration and data access (Medium Blog).

The vulnerability was addressed in subsequent releases of Nagios Log Server. Users should upgrade to a version newer than 2.1.3. The fix was documented in the official changelog (Release Notes).