PT-2024-29578 · Icinga+1 · Icinga Notifications Web+5

Nilmerg · Published 2024-08-05 · Updated 2024-08-06 · CVE-2024-41811

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Low

Base vector

AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Icinga Web versions 2.12.0 and later Icinga DB Web versions 1.0.0 and later Icinga Notifications Web versions 0.1.0 and later Icinga Web JIRA Integration versions 1.3.0 and later

Description The issue is related to cross-site request forgery (CSRF) under certain circumstances. All affected products will be unaffected once the icinga-php-library is upgraded.

Recommendations For Icinga Web versions 2.12.0 and later, upgrade the icinga-php-library to version 0.10.1 or later, which will be published as part of the icinga-php-library v0.14.1 release. For Icinga DB Web versions 1.0.0 and later, upgrade the icinga-php-library to version 0.10.1 or later, which will be published as part of the icinga-php-library v0.14.1 release. For Icinga Notifications Web versions 0.1.0 and later, upgrade the icinga-php-library to version 0.10.1 or later, which will be published as part of the icinga-php-library v0.14.1 release. For Icinga Web JIRA Integration versions 1.3.0 and later, upgrade the icinga-php-library to version 0.10.1 or later, which will be published as part of the icinga-php-library v0.14.1 release.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-41811

GHSA-W9PG-7C3H-FC8J

Affected Products

Debian

Icinga Db Web

Icinga Notifications Web

Icinga Web

Icinga Web Jira Integration

Icinga-Php-Library

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41811.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-41811 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-41811 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41811 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-41811 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w9pg-7c3h-fc8j · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-41811 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-41811 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-41811 · Security Note
• https://github.com/Icinga/icinga-php-library/commit/20c73075a9e9824d089bbd2e433bb2f613fd5801 · Note
• https://github.com/Icinga/ipl-web · Note
• https://github.com/Icinga/ipl-web/security/advisories/GHSA-w9pg-7c3h-fc8j · Note
• https://github.com/Icinga/ipl-web/commit/492336fdb57a5bb0881ed642ab36f5841337571e · Note
• https://t.me/cvedetector/2495 · Telegram Post