CVSS: 7.5EPSS: 23%CPEs: 1EXPL: 6CVE-2022-24716 – Path traversal in Icinga Web 2
https://notcve.org/view.php?id=CVE-2022-24716
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated. Icinga Web 2 es una interfaz web de monitorización de código abierto, un framework y una interfaz de línea de comandos. • https://www.exploit-db.com/exploits/51329 https://github.com/JacobEbben/CVE-2022-24716 https://github.com/joaoviictorti/CVE-2022-24716 https://github.com/doosec101/CVE-2022-24716 https://github.com/antisecc/CVE-2022-24716 https://github.com/pumpkinpiteam/CVE-2022-24716 http://packetstormsecurity.com/files/171774/Icinga-Web-2.10-Arbitrary-File-Disclosure.html https://github.com/Icinga/icingaweb2/commit/9931ed799650f5b8d5e1dc58ea3415a4cdc5773d https://github.com/Icinga/icingaweb2/security/advisories/GHSA • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 4CVE-2022-24715 – Arbitrary code execution for authenticated users in Icinga Web 2
https://notcve.org/view.php?id=CVE-2022-24715
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2. Users unable to upgrade should limit access to the Icinga Web 2 configuration. Icinga Web 2 es una interfaz web de monitorización de código abierto, un framework y una interfaz de línea de comandos. • https://www.exploit-db.com/exploits/51586 https://github.com/JacobEbben/CVE-2022-24715 https://github.com/cxdxnt/CVE-2022-24715 https://github.com/d4rkb0n3/CVE-2022-24715-go http://packetstormsecurity.com/files/173516/Icinga-Web-2.10-Remote-Code-Execution.html https://github.com/Icinga/icingaweb2/commit/a06d915467ca943a4b406eb9587764b8ec34cafb https://github.com/Icinga/icingaweb2/security/advisories/GHSA-v9mv-h52f-7g63 https://security.gentoo.org/glsa/202208-05 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-37698 – Missing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2Writer
https://notcve.org/view.php?id=CVE-2021-37698
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading. • https://github.com/Icinga/icinga2/releases/tag/v2.11.11 https://github.com/Icinga/icinga2/releases/tag/v2.12.6 https://github.com/Icinga/icinga2/releases/tag/v2.13.1 https://github.com/Icinga/icinga2/security/advisories/GHSA-cxfm-8j5v-5qr2 https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html • CWE-295: Improper Certificate Validation •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 2CVE-2021-32743 – Passwords used to access external services inadvertently exposed through API
https://notcve.org/view.php?id=CVE-2021-32743
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions prior to 2.11.10 and from version 2.12.0 through version 2.12.4, some of the Icinga 2 features that require credentials for external services expose those credentials through the API to authenticated API users with read permissions for the corresponding object types. IdoMysqlConnection and IdoPgsqlConnection (every released version) exposes the password of the user used to connect to the database. IcingaDB (added in 2.12.0) exposes the password used to connect to the Redis server. ElasticsearchWriter (added in 2.8.0)exposes the password used to connect to the Elasticsearch server. • https://github.com/Icinga/icinga2/security/advisories/GHSA-wrpw-pmr8-qgj7 https://icinga.com/blog/2021/07/15/releasing-icinga-2-12-5-and-2-11-10 https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html • CWE-202: Exposure of Sensitive Information Through Data Queries •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-32739 – Results of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identities
https://notcve.org/view.php?id=CVE-2021-32739
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a read-ony user's credentials, an attacker can view most attributes of all config objects including `ticket_salt` of `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the master node's certificate, and a self-signed certificate are enough to successfully request the desired certificate from Icinga. • https://github.com/Icinga/icinga2/security/advisories/GHSA-98wp-jc6q-x5q5 https://icinga.com/blog/2021/07/02/releasing-icinga-2-12-5-2-11-10 https://lists.debian.org/debian-lts-announce/2021/11/msg00010.html • CWE-267: Privilege Defined With Unsafe Actions CWE-269: Improper Privilege Management •