PT-2018-14379 · Icinga+1 · Icinga Web 2+1
Publicado
2018-12-17
·
Atualizado
2020-01-16
·
CVE-2018-18247
CVSS v3.1
5.4
Média
| Vetor | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Icinga Web 2 versions prior to 2.6.2
Description
The issue is related to a security problem where an attacker can execute malicious scripts on a user's browser, potentially leading to unauthorized actions. This is achieved through the "/icingaweb2/navigation/add" API endpoint, specifically by manipulating the
icon parameter.Recommendations
For versions prior to 2.6.2, update to version 2.6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/icingaweb2/navigation/add" API endpoint to minimize the risk of exploitation. Avoid using the
icon parameter in the affected endpoint until the issue is resolved.Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Icinga Web 2
Suse