// For flags

CVE-2022-24714

Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service objects, users with said roles may still have access to a collection of content. Note that this only applies if a role has implicitly permitted access to hosts, due to permitted access to at least one of their services. If access to a host is permitted by other means, no sensible information has been disclosed to unauthorized users. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2.

Icinga Web 2 es una interfaz web de monitorización de código abierto, un framework y una interfaz de línea de comandos. Las instalaciones de Icinga 2 con el escritor IDO activado están afectadas. Si se utilizan variables personalizadas de servicio en las restricciones de rol, y se desmantelan regularmente los objetos de servicio, los usuarios con dichos roles pueden seguir teniendo acceso a una colección de contenido. Tenga en cuenta que esto sólo se aplica si un rol tiene permitido implícitamente el acceso a los hosts, debido al acceso permitido a al menos uno de sus servicios. Si se permite el acceso a un host por otros medios, no se ha revelado información sensible a usuarios no autorizados. Este problema ha sido resuelto en las versiones 2.8.6, 2.9.6 y 2.10 de Icinga Web 2

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-02-10 CVE Reserved
  • 2022-03-08 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-11-21 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-863: Incorrect Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Icinga
Search vendor "Icinga"
 Icinga Web 2
Search vendor "Icinga" for product "Icinga Web 2"
 < 2.8.6
Search vendor "Icinga" for product "Icinga Web 2" and version " < 2.8.6"
-
Affected
Icinga
Search vendor "Icinga"
 Icinga Web 2
Search vendor "Icinga" for product "Icinga Web 2"
 >= 2.9.0 < 2.9.6
Search vendor "Icinga" for product "Icinga Web 2" and version " >= 2.9.0 < 2.9.6"
-
Affected