PT-2022-16824 · Unknown+1 · Icinga Web 2+1

Nilmerg + 1 · Published 2022-03-08 · Updated 2023-07-17 · CVE-2022-24715

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.8.6 Icinga Web 2 versions prior to 2.9.6 Icinga Web 2 versions prior to 2.10

Description Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code.

Recommendations For versions prior to 2.8.6, update to version 2.8.6 or later. For versions prior to 2.9.6, update to version 2.9.6 or later. For versions prior to 2.10, update to version 2.10 or later. As a temporary workaround for users unable to upgrade, limit access to the Icinga Web 2 configuration.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-24715

GHSA-V9MV-H52F-7G63

OPENSUSE-SU-2022:0087-1

OPENSUSE-SU-2022:0097-1

Affected Products

Debian

Icinga Web 2

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24715.json · Exploit
• 🔥 https://github.com/JacobEbben/CVE-2022-24715 · Exploit
• 🔥 https://exploit-db.com/exploits/51586 · Exploit
• https://github.com/Icinga/icingaweb2/commit/a06d915467ca943a4b406eb9587764b8ec34cafb · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:0087-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24715 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24715 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-24715 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-24715 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24715 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24715 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-24715 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:0097-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202208-05 · Vendor Advisory
• https://github.com/Icinga/icingaweb2/security/advisories/GHSA-v9mv-h52f-7g63 · Note