CVE-2022-24715

High

Description

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2. Users unable to upgrade should limit access to the Icinga Web 2 configuration.

SeverityHigh

CVSS8.5

Exploit probability—

ProductIcinga Web

PublishedMar 8, 2022

First seenMar 8, 2022

Weakness typeCWE-22Path traversal

How to fix

Update

icinga icinga_web_22.8.6, 2.9.6 or later

Vendor advisories

security.gentoo.org/glsa/202208-05

Affected products

Product	Affected versions	Fixed in
icinga icinga_web_2	v < 2.8.6, 2.9.0 ≤ v < 2.9.6	2.8.6, 2.9.6

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.