PT-2022-16823 · Icinga+1 · Icinga 2+2

Nilmerg · Published 2022-03-08 · Updated 2022-11-09 · CVE-2022-24714

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.8.6 Icinga Web 2 versions prior to 2.9.6 Icinga Web 2 versions prior to 2.10

Description Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service objects, users with said roles may still have access to a collection of content. Note that this only applies if a role has implicitly permitted access to hosts, due to permitted access to at least one of their services. If access to a host is permitted by other means, no sensible information has been disclosed to unauthorized users.

Recommendations For Icinga Web 2 versions prior to 2.8.6, update to version 2.8.6 or later. For Icinga Web 2 versions prior to 2.9.6, update to version 2.9.6 or later. For Icinga Web 2 versions prior to 2.10, update to version 2.10 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-24714

GHSA-QCMG-VR56-X9WF

OPENSUSE-SU-2022:0087-1

OPENSUSE-SU-2022:0097-1

Affected Products

Debian

Icinga 2

Icinga Web 2

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24714.json · Exploit
• https://github.com/Icinga/icingaweb2/commit/6e989d05a1568a6733a3d912001251acc51d9293 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:0087-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-24714 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-24714 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-24714 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24714 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24714 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24714 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:0097-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202208-05 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-24714 · Vendor Advisory
• https://github.com/Icinga/icingaweb2/security/advisories/GHSA-qcmg-vr56-x9wf · Note
• https://bugzilla.suse.com/1196911 · Note
• https://bugzilla.suse.com/1196913 · Note